Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1436950
MD5:	51014f1c86736d8f91d432548062ebbf
SHA1:	6d0bab0a443ff43c293f57dface65dfea47501a9
SHA256:	1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has nameless sections

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 51014F1C86736D8F91D432548062EBBF)

schtasks.exe (PID: 7488 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7536 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7324 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 1980 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 7584 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 51014F1C86736D8F91D432548062EBBF)

WerFault.exe (PID: 2816 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 1960 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 7592 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 51014F1C86736D8F91D432548062EBBF)

RageMP131.exe (PID: 7672 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 51014F1C86736D8F91D432548062EBBF)

WerFault.exe (PID: 8136 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 1944 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 7784 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 51014F1C86736D8F91D432548062EBBF)

WerFault.exe (PID: 6536 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 1908 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\wwigCWSFuz2MihL8u4G1uFC.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\9wBRx7ST9VOnJqni_JpioUs.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\tC131VXqxqwXyoqOe7muh9i.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\PSdiYEtw_DOSPKoK_uBheap.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2173403489.0000000001838000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2023815185.0000000001CEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1907164226.0000000001CE6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.2022464307.000000000191E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000003.2110910326.0000000001838000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2173403489.000000000174D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file.exe PID: 7428	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file.exe PID: 7428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7584	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7584	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7592	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7672	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7784	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7784	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 7428, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/06/24-20:08:42.332746
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/06/24-20:08:11.803337
SID:	2046267
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/06/24-20:07:53.913307
SID:	2046266
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/06/24-20:07:57.036164
SID:	2046269
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/06/24-20:07:53.682907
SID:	2049060
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/06/24-20:08:04.120685
SID:	2046266
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/06/24-20:08:05.646832
SID:	2046267
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/06/24-20:07:56.321028
SID:	2046266
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/06/24-20:08:18.051763
SID:	2046269
Source Port:	49738
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/06/24-20:07:56.309289
SID:	2046266
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/06/24-20:08:11.640975
SID:	2046266
Source Port:	58709
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/06/24-20:08:15.381006
SID:	2046267
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	05/06/24-20:08:11.897367
SID:	2046267
Source Port:	58709
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/06/24-20:08:09.259896
SID:	2046269
Source Port:	49733
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	05/06/24-20:08:30.364347
SID:	2046269
Source Port:	49732
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://147.45.47.102:57893/hera/amadka.exe

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://147.45.47.102:57893/hera/amadka.exe	Virustotal: Detection: 19%	Perma Link
Source: http://193.233.132.56/cost/lenin.exesepro	Virustotal: Detection: 21%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exe68.0	Virustotal: Detection: 15%	Perma Link
Source: http://193.233.132.56/cost/go.exe00.1	Virustotal: Detection: 18%	Perma Link
Source: http://193.233.132.56/cost/go.exe	Virustotal: Detection: 25%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exeN	Virustotal: Detection: 18%	Perma Link
Source: http://193.233.132.56/cost/lenin.exe	Virustotal: Detection: 26%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 39%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 39%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 39%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 38%			Perma Link
Source: file.exe	ReversingLabs: Detection: 39%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01036A80 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_01036A80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003A6A80 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		5_2_003A6A80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49750 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010566F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_010566F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01035F80 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_01035F80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA1F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00FA1F9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104FE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0104FE80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	0_2_01003EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA2022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00FA2022
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_01003850
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003C66F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_003C66F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003BFE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_003BFE80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00373EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	5_2_00373EC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00311F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00311F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003A5F80 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_003A5F80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00312022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_00312022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00373850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_00373850

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_751fa919568148cae58711204775ef674bafd71f_50e30abd_2c1d9ae0-1b69-4126-ae64-d738448a55b5\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d8cfe4b0b9575b2ab71f14e55e4d6484872cb94_df5fde7b_aa9d6a92-8d2d-4559-99fe-1b134b7dfc56\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49731 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49733 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49738
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49738
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49738 -> 147.45.47.93:58709

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.93 147.45.47.93
Source: Joe Sandbox View	IP Address: 104.26.5.15 104.26.5.15

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F880A0 recv,

0_2_00F880A0

Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874348802.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe68.0
Source: RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874348802.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeD)a#
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeData
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeDatae
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeN
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeletsM
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exe
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exe00.1
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exe1
Source: RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.execoin
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exe
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exe)
Source: RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exeUser
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exerbirdox/i
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exesepro
Source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: Amcache.hve.18.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170553211.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119820314.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020629490.0000000000611000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014597460.0000000000611000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101
Source: MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101(
Source: MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101D
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101c
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101g
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101s
Source: MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/ggg
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=84.17.40.101
Source: RageMP131.exe, 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=84.17.40.101e
Source: MPGPH131.exe, 00000005.00000002.2173403489.000000000174D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=84.17.40.101o
Source: file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 00000008.00000002.2015798047.000000000199B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001963000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: file.exe, 00000000.00000002.2023815185.0000000001C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017D1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: file.exe, 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170553211.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119820314.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020629490.0000000000611000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014597460.0000000000611000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: file.exe, 00000000.00000002.2023815185.0000000001C28000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2023815185.0000000001C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017D1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.000000000178A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.000000000167F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.000000000195B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/84.17.40.101
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/84.17.40.101~W
Source: file.exe, 00000000.00000002.2023815185.0000000001C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.000000000174D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.0000000001647000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/84.17.40.101
Source: 3b6N2Xdh3CYwplaces.sqlite.8.dr	String found in binary or memory: https://support.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.8.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3b6N2Xdh3CYwplaces.sqlite.8.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1864720375.0000000001D49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867274750.0000000001D67000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099216190.00000000018B0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2104564573.00000000018C5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822281358.0000000001A79000.00000004.00000020.00020000.00000000.sdmp, ELASOvMcSsNrHistory.7.dr, vd0z8wzGefD1History.8.dr, LhmhqtkXTkbYHistory.0.dr, iCl1DNg_vvFNHistory.5.dr, QZolPj_wU7yvHistory.8.dr, BhPLdlMH4HviHistory.5.dr, UqNl41FdpO7sHistory.0.dr, OAwfuvRJ7Zo3History.7.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: ELASOvMcSsNrHistory.7.dr, vd0z8wzGefD1History.8.dr, LhmhqtkXTkbYHistory.0.dr, iCl1DNg_vvFNHistory.5.dr, QZolPj_wU7yvHistory.8.dr, BhPLdlMH4HviHistory.5.dr, UqNl41FdpO7sHistory.0.dr, OAwfuvRJ7Zo3History.7.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1864720375.0000000001D49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867274750.0000000001D67000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099216190.00000000018B0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2104564573.00000000018C5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822281358.0000000001A79000.00000004.00000020.00020000.00000000.sdmp, ELASOvMcSsNrHistory.7.dr, vd0z8wzGefD1History.8.dr, LhmhqtkXTkbYHistory.0.dr, iCl1DNg_vvFNHistory.5.dr, QZolPj_wU7yvHistory.8.dr, BhPLdlMH4HviHistory.5.dr, UqNl41FdpO7sHistory.0.dr, OAwfuvRJ7Zo3History.7.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: ELASOvMcSsNrHistory.7.dr, vd0z8wzGefD1History.8.dr, LhmhqtkXTkbYHistory.0.dr, iCl1DNg_vvFNHistory.5.dr, QZolPj_wU7yvHistory.8.dr, BhPLdlMH4HviHistory.5.dr, UqNl41FdpO7sHistory.0.dr, OAwfuvRJ7Zo3History.7.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.4
Source: RageMP131.exe, 00000007.00000002.2022464307.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp, 9wBRx7ST9VOnJqni_JpioUs.zip.5.dr, wwigCWSFuz2MihL8u4G1uFC.zip.8.dr, tC131VXqxqwXyoqOe7muh9i.zip.7.dr, PSdiYEtw_DOSPKoK_uBheap.zip.0.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: RageMP131.exe, 00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT7
Source: MPGPH131.exe, 00000005.00000002.2173403489.0000000001838000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2110910326.0000000001838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTli
Source: file.exe, 00000000.00000002.2023815185.0000000001CEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907164226.0000000001CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTm
Source: MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1844046240.0000000001A1A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1873756554.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.5.dr, passwords.txt.8.dr, passwords.txt.7.dr, passwords.txt.0.dr	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot#
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot&
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot4.17.40.101
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlater
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bots
Source: file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: 3b6N2Xdh3CYwplaces.sqlite.8.dr	String found in binary or memory: https://www.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.8.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 3b6N2Xdh3CYwplaces.sqlite.8.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1871264871.0000000001A5F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1870214972.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1873024686.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1863834626.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1866365018.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1870708054.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864231696.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1863653168.0000000001A64000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1866548748.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874348802.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864002119.0000000001A64000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1870547168.0000000001A5F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865973953.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1869370494.0000000001A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1907164226.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863659568.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1872810764.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1866453313.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1873275007.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1870000195.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865095538.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1866116710.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863851821.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1870498691.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2023815185.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864448208.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863077396.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1871475354.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865890235.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864066032.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865369865.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1870911713.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102332006.000000000189A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2107790457.000000000189A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2098278909.000000000189A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/I
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/S
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/T
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/d
Source: 3b6N2Xdh3CYwplaces.sqlite.8.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1871264871.0000000001A5F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1870214972.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1873024686.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1863834626.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1866365018.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1870708054.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864231696.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1863653168.0000000001A64000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1866548748.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874348802.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864002119.0000000001A64000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1870547168.0000000001A5F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865973953.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1869370494.0000000001A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/-
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/eagonF
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/
Source: file.exe, 00000000.00000003.1907164226.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863659568.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1872810764.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1866453313.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1873275007.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1870000195.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865095538.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1866116710.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863851821.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1870498691.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2023815185.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864448208.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1863077396.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1871475354.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865890235.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864066032.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1865369865.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1870911713.0000000001D42000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102332006.000000000189A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2107790457.000000000189A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2098278909.000000000189A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/r
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874348802.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ta

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49750 version: TLS 1.2

System Summary

PE file has nameless sections

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101A180	0_2_0101A180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB002D	0_2_00FB002D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100F050	0_2_0100F050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100D320	0_2_0100D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01006330	0_2_01006330
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104E3B0	0_2_0104E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010003C0	0_2_010003C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01047580	0_2_01047580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010AF480	0_2_010AF480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01008630	0_2_01008630
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7B8E0	0_2_00F7B8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC8BB0	0_2_00FC8BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF1B90	0_2_00FF1B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106AC30	0_2_0106AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104EFB0	0_2_0104EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104FE80	0_2_0104FE80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003EC0	0_2_01003EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100AEE0	0_2_0100AEE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003000	0_2_01003000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA71A0	0_2_00FA71A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB036F	0_2_00FB036F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010142A0	0_2_010142A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01013590	0_2_01013590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B85F0	0_2_010B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9F580	0_2_00F9F580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF4560	0_2_00FF4560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01057760	0_2_01057760
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC2610	0_2_00FC2610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC47BF	0_2_00FC47BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B7690	0_2_010B7690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAC960	0_2_00FAC960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAA928	0_2_00FAA928
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBDA86	0_2_00FBDA86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0105FBA0	0_2_0105FBA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0105EBA0	0_2_0105EBA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B5D10	0_2_010B5D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B6C50	0_2_010B6C50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010A4C70	0_2_010A4C70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01062F30	0_2_01062F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC8E30	0_2_00FC8E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B1E30	0_2_010B1E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0000	0_2_7EAF0000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF09A3	0_2_7EAF09A3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0032002D	5_2_0032002D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0037F050	5_2_0037F050
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0038A180	5_2_0038A180
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00376330	5_2_00376330
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0037D320	5_2_0037D320
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003BE3B0	5_2_003BE3B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003703C0	5_2_003703C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0041F480	5_2_0041F480
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003B7580	5_2_003B7580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00378630	5_2_00378630
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_002EB8E0	5_2_002EB8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00361B90	5_2_00361B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003DAC30	5_2_003DAC30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00425D10	5_2_00425D10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003BFE80	5_2_003BFE80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0037AEE0	5_2_0037AEE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00373EC0	5_2_00373EC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003BEFB0	5_2_003BEFB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00373000	5_2_00373000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003171A0	5_2_003171A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003842A0	5_2_003842A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0032036F	5_2_0032036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00364560	5_2_00364560
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00383590	5_2_00383590
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0030F580	5_2_0030F580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004285F0	5_2_004285F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00427690	5_2_00427690
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003C7760	5_2_003C7760
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003347BF	5_2_003347BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0031A928	5_2_0031A928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0031C960	5_2_0031C960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0032DA86	5_2_0032DA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00338BB0	5_2_00338BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003CEBA0	5_2_003CEBA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003CFBA0	5_2_003CFBA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00426C50	5_2_00426C50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00414C70	5_2_00414C70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00338E30	5_2_00338E30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00421E30	5_2_00421E30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003D2F30	5_2_003D2F30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_7F0409A3	5_2_7F0409A3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_7F040000	5_2_7F040000

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F8ACE0 appears 86 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 002FACE0 appears 86 times

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 1944

Source: file.exe, 00000000.00000000.1612444595.0000000001111000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9999685247031382
Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983648255813954
Source: file.exe	Static PE information: Section: ZLIB complexity 0.9970703125
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9999685247031382
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983648255813954
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9970703125
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9999685247031382
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983648255813954
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9970703125

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@15/106@2/3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0104FE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_0104FE80

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7784
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7672
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7584
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7428
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170553211.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119820314.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020629490.0000000000611000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014597460.0000000000611000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170553211.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119820314.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020629490.0000000000611000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014597460.0000000000611000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000003.1907164226.0000000001D16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1872810764.0000000001D16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1873275007.0000000001D16000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2023815185.0000000001D16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE segment_dV;
Source: RageMP131.exe, 00000007.00000003.1819367845.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1819751197.0000000001A42000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1863834626.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864231696.0000000001A63000.00000004.00000020.00020000.00000000.sdmp, cCZagzzOxnzSLogin Data For Account.7.dr, a7mDNvwnbxnHLogin Data For Account.8.dr, TLE_gXdWplrQLogin Data.0.dr, S1kWLfoUHhbSLogin Data.5.dr, LjKc4cZCdkn6Login Data.8.dr, KD92s1mFJPJgLogin Data For Account.0.dr, h7vTUP6iIQXbLogin Data.7.dr, ZhaKbTXVRlMcLogin Data For Account.5.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Virustotal: Detection: 38%
Source: file.exe	ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 1944
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 1908
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 1980
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 1960
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: file.exe

Static file information: File size 3188736 > 1048576

Source: file.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x221000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.f70000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 5.2.MPGPH131.exe.2e0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 6.2.MPGPH131.exe.2e0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 7.2.RageMP131.exe.610000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 8.2.RageMP131.exe.610000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0103F200 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_0103F200

Source: initial sample

Static PE information: section where entry point is pointing to: .data

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA3F59 push ecx; ret	0_2_00FA3F6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF16A0 push 7EAF0002h; ret	0_2_7EAF16AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1EB0 push 7EAF0002h; ret	0_2_7EAF1EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1E80 push 7EAF0002h; ret	0_2_7EAF1E8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0E90 push 7EAF0002h; ret	0_2_7EAF0E9F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF2690 push 7EAF0002h; ret	0_2_7EAF269F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1EE0 push 7EAF0002h; ret	0_2_7EAF1EEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0EF0 push 7EAF0002h; ret	0_2_7EAF0EFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF26F0 push 7EAF0002h; ret	0_2_7EAF26FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0EC0 push 7EAF0002h; ret	0_2_7EAF0ECF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF26C0 push 7EAF0002h; ret	0_2_7EAF26CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF16D0 push 7EAF0002h; ret	0_2_7EAF16DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1E20 push 7EAF0002h; ret	0_2_7EAF1E2F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0E30 push 7EAF0002h; ret	0_2_7EAF0E3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF2630 push 7EAF0002h; ret	0_2_7EAF263F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0E00 push 7EAF0002h; ret	0_2_7EAF0E0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF2600 push 7EAF0002h; ret	0_2_7EAF260F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1610 push 7EAF0002h; ret	0_2_7EAF161F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0E60 push 7EAF0002h; ret	0_2_7EAF0E6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF2660 push 7EAF0002h; ret	0_2_7EAF266F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1670 push 7EAF0002h; ret	0_2_7EAF167F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1640 push 7EAF0002h; ret	0_2_7EAF164F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1E50 push 7EAF0002h; ret	0_2_7EAF1E5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1FA0 push 7EAF0002h; ret	0_2_7EAF1FAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0FB0 push 7EAF0002h; ret	0_2_7EAF0FBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF27B0 push 7EAF0002h; ret	0_2_7EAF27BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0F80 push 7EAF0002h; ret	0_2_7EAF0F8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF2780 push 7EAF0002h; ret	0_2_7EAF278F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF1790 push 7EAF0002h; ret	0_2_7EAF179F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF0FE0 push 7EAF0002h; ret	0_2_7EAF0FEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_7EAF27E0 push 7EAF0002h; ret	0_2_7EAF27EF

Source: file.exe	Static PE information: section name: entropy: 7.999675017725288
Source: file.exe	Static PE information: section name: entropy: 7.99639087266641
Source: file.exe	Static PE information: section name: entropy: 7.83802229172669
Source: file.exe	Static PE information: section name: entropy: 7.972593331740996
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.999675017725288
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.99639087266641
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.83802229172669
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.972593331740996
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.999675017725288
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.99639087266641
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.83802229172669
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.972593331740996

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\file.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-47148
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 751			Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 1120			Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Source: C:\Users\user\Desktop\file.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-47148

Source: C:\Users\user\Desktop\file.exe	Evaded block: after key decision			graph_0-50901
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evaded block: after key decision

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-47978

Source: C:\Users\user\Desktop\file.exe TID: 7432	Thread sleep count: 751 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7432	Thread sleep count: 117 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7588	Thread sleep count: 1120 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7588	Thread sleep count: 117 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7588	Thread sleep count: 108 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7596	Thread sleep count: 349 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7596	Thread sleep count: 134 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7596	Thread sleep count: 106 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7676	Thread sleep count: 117 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7676	Thread sleep count: 55 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7788	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7788	Thread sleep count: 308 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7788	Thread sleep count: 31 > 30

Source: C:\Users\user\Desktop\file.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010566F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_010566F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01035F80 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_01035F80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA1F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00FA1F9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104FE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0104FE80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	0_2_01003EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA2022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00FA2022
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_01003850
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003C66F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_003C66F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003BFE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_003BFE80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00373EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	5_2_00373EC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00311F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00311F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003A5F80 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_003A5F80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00312022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_00312022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00373850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_00373850

Source: C:\Users\user\Desktop\file.exe

0_2_0104FE80

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_751fa919568148cae58711204775ef674bafd71f_50e30abd_2c1d9ae0-1b69-4126-ae64-d738448a55b5\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d8cfe4b0b9575b2ab71f14e55e4d6484872cb94_df5fde7b_aa9d6a92-8d2d-4559-99fe-1b134b7dfc56\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue

Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.2023815185.0000000001C49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(j
Source: RageMP131.exe, 00000008.00000003.1872875473.0000000001AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Dk&Ven_VMware&P
Source: RageMP131.exe, 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000L
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.1872700677.0000000001D57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.18.dr	Binary or memory string: vmci.sys
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: vmware
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: MPGPH131.exe, 00000006.00000003.1661761468.00000000016B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}l
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: Amcache.hve.18.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.18.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual RAM
Source: RageMP131.exe, 00000008.00000003.1874545027.0000000001A92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\*
Source: Amcache.hve.18.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual USB Mouse
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: RageMP131.exe, 00000008.00000003.1874545027.0000000001A92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: MPGPH131.exe, 00000006.00000002.2121250052.000000000169C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000N
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_7A82178D
Source: Amcache.hve.18.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Hyper-V (guest)
Source: Amcache.hve.18.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RageMP131.exe, 00000008.00000002.2015798047.000000000199B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}uV
Source: Amcache.hve.18.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: Amcache.hve.18.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.18.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.00000000005BE000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.00000000005BE000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000008EE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000008EE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.00000000005BE000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.00000000005BE000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000008EE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000008EE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.00000000005BE000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.00000000005BE000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000008EE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000008EE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^b
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Hyper-V
Source: Amcache.hve.18.dr	Binary or memory string: VMware
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Amcache.hve.18.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}/7rrP9UK+nYJkDUaruLFsmiax3GAXC2Igj63N1koqBHsy38rIIvg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}9
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.000000000169C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.000000000197C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001993000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: RageMP131.exe, 00000008.00000003.1815205780.00000000019A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}tV
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: RageMP131.exe, 00000007.00000003.1739888881.000000000198D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000005.00000003.2110910326.0000000001838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: Amcache.hve.18.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ta\*
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}iles\fqs92o4p.default-release\signons.sqlite-journal
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: Amcache.hve.18.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.18.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.18.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.18.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.18.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.18.dr	Binary or memory string: VMware VMCI Bus Device
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.18.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: RageMP131.exe, 00000008.00000003.1874545027.0000000001A92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Only
Source: RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_7A82178D-
Source: Amcache.hve.18.dr	Binary or memory string: vmci.syshbin
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: Amcache.hve.18.dr	Binary or memory string: VMware, Inc.
Source: RageMP131.exe, 00000007.00000003.1831034423.0000000001A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}OT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0)S)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: Amcache.hve.18.dr	Binary or memory string: VMware20,1hbin@
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: xVBoxService.exe
Source: Amcache.hve.18.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: Amcache.hve.18.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: Amcache.hve.18.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$
Source: RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: VBoxService.exe
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: MPGPH131.exe, 00000005.00000002.2173403489.00000000017A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXz~
Source: Amcache.hve.18.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: VMWare
Source: Amcache.hve.18.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: file.exe, file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: RageMP131.exe, 00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J6HEdjEHUub5EtqTQ2dk3wwrCNfruTWZeEqONRrqgXAW0ke6pZXg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*
Source: RageMP131.exe, 00000007.00000002.2022464307.000000000191E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170943123.000000000048E000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119993872.000000000048E000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020826787.00000000007BE000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014794487.00000000007BE000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FA8A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00FA8A64

Source: C:\Users\user\Desktop\file.exe

0_2_0103F200

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01036D00 mov eax, dword ptr fs:[00000030h]	0_2_01036D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003EC0 mov eax, dword ptr fs:[00000030h]	0_2_01003EC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003A6D00 mov eax, dword ptr fs:[00000030h]	5_2_003A6D00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00373EC0 mov eax, dword ptr fs:[00000030h]	5_2_00373EC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010599F0 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

0_2_010599F0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00FA451D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA8A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FA8A64
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0031451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0031451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00318A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00318A64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0103F200 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_0103F200
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_003AF200 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		5_2_003AF200

Source: C:\Users\user\Desktop\file.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0104FE80
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00FC31CA
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00FBB1B1
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00FC32F3
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00FC33F9
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00FC34CF
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00FBB734
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00FC2B5A
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00FC2D5F
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00FC2EEC
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00FC2E51
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00FC2E06
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00FC2F77
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_003BFE80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_0032B1B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_003331CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_003332F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_003333F9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_003334CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_0032B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00332B5A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_00332D5F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00332E06
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00332E51
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00332EEC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00332F77

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

0_2_0104FE80

Source: C:\Users\user\Desktop\file.exe

0_2_0104FE80

Source: C:\Users\user\Desktop\file.exe

0_2_0104FE80

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.18.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000005.00000002.2173403489.0000000001838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2023815185.0000000001CEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1907164226.0000000001CE6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2022464307.000000000191E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2110910326.0000000001838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2173403489.000000000174D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwigCWSFuz2MihL8u4G1uFC.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\9wBRx7ST9VOnJqni_JpioUs.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\tC131VXqxqwXyoqOe7muh9i.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\PSdiYEtw_DOSPKoK_uBheap.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx0gA
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsTP
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet*;T
Source: file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7784, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000005.00000002.2173403489.0000000001838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2023815185.0000000001CEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1907164226.0000000001CE6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2022464307.000000000191E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2110910326.0000000001838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2173403489.000000000174D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwigCWSFuz2MihL8u4G1uFC.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\9wBRx7ST9VOnJqni_JpioUs.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\tC131VXqxqwXyoqOe7muh9i.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\PSdiYEtw_DOSPKoK_uBheap.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	12 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	38%	Virustotal		Browse
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\MPGPH131\MPGPH131.exe	40%	Virustotal		Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	40%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://pki-ocsp.symauth.com0	0%	URL Reputation	safe
http://147.45.47.102:57893/hera/amadka.exeDatae	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe	100%	Avira URL Cloud	malware
http://147.45.47.102:57893/hera/amadka.exe68.0	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exerbirdox/i	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exeD)a#	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.exe	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exe)	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exesepro	0%	Avira URL Cloud	safe
https://t.4	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exeUser	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe	20%	Virustotal		Browse
http://193.233.132.56/cost/go.exe00.1	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exeData	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exesepro	22%	Virustotal		Browse
http://193.233.132.56/cost/go.exe1	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exeletsM	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe68.0	15%	Virustotal		Browse
http://147.45.47.102:57893/hera/amadka.exeN	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.exe00.1	18%	Virustotal		Browse
http://193.233.132.56/cost/lenin.exe	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.exe	25%	Virustotal		Browse
http://193.233.132.56/cost/go.execoin	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exeN	18%	Virustotal		Browse
http://193.233.132.56/cost/lenin.exe	26%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.5.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://db-ip.com/demo/home.php?s=84.17.40.101	false		high
https://ipinfo.io/widget/demo/84.17.40.101	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://db-ip.com/demo/home.php?s=84.17.40.101c	RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	3b6N2Xdh3CYwplaces.sqlite.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	false		high
https://t.me/RiseProSUPPORTm	file.exe, 00000000.00000002.2023815185.0000000001CEC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907164226.0000000001CE6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=84.17.40.101g	file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe	file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874348802.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	false		high
https://db-ip.com/	file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=84.17.40.101s	RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTli	MPGPH131.exe, 00000005.00000002.2173403489.0000000001838000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2110910326.0000000001838000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe68.0	RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1864720375.0000000001D49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867274750.0000000001D67000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099216190.00000000018B0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2104564573.00000000018C5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822281358.0000000001A79000.00000004.00000020.00020000.00000000.sdmp, ELASOvMcSsNrHistory.7.dr, vd0z8wzGefD1History.8.dr, LhmhqtkXTkbYHistory.0.dr, iCl1DNg_vvFNHistory.5.dr, QZolPj_wU7yvHistory.8.dr, BhPLdlMH4HviHistory.5.dr, UqNl41FdpO7sHistory.0.dr, OAwfuvRJ7Zo3History.7.dr	false		high
http://147.45.47.102:57893/hera/amadka.exeDatae	MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.56/cost/lenin.exerbirdox/i	file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.102:57893/hera/amadka.exeD)a#	RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874348802.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro	MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/lenin.exe)	file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.56/cost/go.exe	RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=84.17.40.101e	RageMP131.exe, 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot&	RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot#	MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	ELASOvMcSsNrHistory.7.dr, vd0z8wzGefD1History.8.dr, LhmhqtkXTkbYHistory.0.dr, iCl1DNg_vvFNHistory.5.dr, QZolPj_wU7yvHistory.8.dr, BhPLdlMH4HviHistory.5.dr, UqNl41FdpO7sHistory.0.dr, OAwfuvRJ7Zo3History.7.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	false		high
https://t.me/risepro_botisepro_bot	file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/lenin.exesepro	RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/84.17.40.101~W	RageMP131.exe, 00000008.00000002.2015798047.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/ggg	MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT7	RageMP131.exe, 00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.4	MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	false		high
https://db-ip.com/demo/home.php?s=84.17.40.101(	MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	file.exe, 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170553211.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119820314.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020629490.0000000000611000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014597460.0000000000611000.00000040.00000001.01000000.00000005.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	false		high
http://193.233.132.56/cost/lenin.exeUser	RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot4.17.40.101	RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.18.dr	false		high
https://db-ip.com:443/demo/home.php?s=84.17.40.101o	MPGPH131.exe, 00000005.00000002.2173403489.000000000174D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT	RageMP131.exe, 00000007.00000002.2022464307.000000000191E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp, 9wBRx7ST9VOnJqni_JpioUs.zip.5.dr, wwigCWSFuz2MihL8u4G1uFC.zip.8.dr, tC131VXqxqwXyoqOe7muh9i.zip.7.dr, PSdiYEtw_DOSPKoK_uBheap.zip.0.dr	false		high
http://193.233.132.56/cost/go.exe00.1	RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1864720375.0000000001D49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867274750.0000000001D67000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099216190.00000000018B0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2104564573.00000000018C5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822281358.0000000001A79000.00000004.00000020.00020000.00000000.sdmp, ELASOvMcSsNrHistory.7.dr, vd0z8wzGefD1History.8.dr, LhmhqtkXTkbYHistory.0.dr, iCl1DNg_vvFNHistory.5.dr, QZolPj_wU7yvHistory.8.dr, BhPLdlMH4HviHistory.5.dr, UqNl41FdpO7sHistory.0.dr, OAwfuvRJ7Zo3History.7.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	false		high
https://ipinfo.io/Mozilla/5.0	file.exe, 00000000.00000002.2023815185.0000000001C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.00000000017D1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	3b6N2Xdh3CYwplaces.sqlite.8.dr	false		high
http://147.45.47.102:57893/hera/amadka.exeData	RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	false		high
http://193.233.132.56/cost/go.exe1	RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=84.17.40.101D	MPGPH131.exe, 00000006.00000002.2121250052.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot	RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1844046240.0000000001A1A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1873756554.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.5.dr, passwords.txt.8.dr, passwords.txt.7.dr, passwords.txt.0.dr	false		high
http://147.45.47.102:57893/hera/amadka.exeletsM	file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botlater	MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/	RageMP131.exe, 00000008.00000002.2015798047.000000000199B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001963000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pki-ocsp.symauth.com0	file.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr	false	URL Reputation: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	file.exe, MPGPH131.exe	false		high
http://147.45.47.102:57893/hera/amadka.exeN	MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=84.17.40.101	file.exe, 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.0000000001647000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/lenin.exe	RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001A66000.00000004.00000020.00020000.00000000.sdmp	false	26%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	file.exe, 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2170553211.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000002.2119820314.00000000002E1000.00000040.00000001.01000000.00000004.sdmp, RageMP131.exe, 00000007.00000002.2020629490.0000000000611000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.2014597460.0000000000611000.00000040.00000001.01000000.00000005.sdmp	false		high
https://support.mozilla.org	3b6N2Xdh3CYwplaces.sqlite.8.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	ELASOvMcSsNrHistory.7.dr, vd0z8wzGefD1History.8.dr, LhmhqtkXTkbYHistory.0.dr, iCl1DNg_vvFNHistory.5.dr, QZolPj_wU7yvHistory.8.dr, BhPLdlMH4HviHistory.5.dr, UqNl41FdpO7sHistory.0.dr, OAwfuvRJ7Zo3History.7.dr	false		high
https://ipinfo.io:443/widget/demo/84.17.40.101	file.exe, 00000000.00000002.2023815185.0000000001C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2173403489.000000000174D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2121250052.0000000001647000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2022464307.00000000019A2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bots	MPGPH131.exe, 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2056651399.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1865241711.0000000001D6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1864375367.0000000001D5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1867863334.0000000001D78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2099008633.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2102021978.00000000018D2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2105243412.00000000018E7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820028873.0000000001A7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1822926347.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1820619276.0000000001A9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1867422417.0000000001AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1864465481.0000000001A98000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1865350119.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, DOGuPW8VgXDwWeb Data.5.dr, 1bA0iPxs1_tpWeb Data.8.dr, Z82s7O924lLeWeb Data.5.dr, Y7ezkClN3tvGWeb Data.0.dr, QALFCGqIe0GzWeb Data.8.dr, V9veGYQ701aZWeb Data.7.dr, 4deeADJYPmpQWeb Data.0.dr, pTWMc6sLNinTWeb Data.7.dr, 42h4yDt09kAFWeb Data.7.dr	false		high
http://193.233.132.56/cost/go.execoin	RageMP131.exe, 00000008.00000003.1874959213.0000000001A65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.1874632671.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
104.26.5.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436950
Start date and time:	2024-05-06 20:07:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@15/106@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 58% Number of executed functions: 56 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 52.182.143.212
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:07:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
19:07:53	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
19:07:53	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
19:08:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
20:08:28	API Interceptor	80x Sleep call for process: MPGPH131.exe modified
20:08:29	API Interceptor	4x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.93	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse
	hYrJbjnzVc.exe	Get hash	malicious	RisePro Stealer	Browse
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse
	RY5YJaMEWE.exe	Get hash	malicious	RisePro Stealer	Browse
	OUZXNOqKXg.exe	Get hash	malicious	RisePro Stealer	Browse
	0BzQNa8hYd.exe	Get hash	malicious	RisePro Stealer	Browse
104.26.5.15	SecuriteInfo.com.Win64.Evo-gen.17494.7440.exe	Get hash	malicious	Unknown	Browse	api.db-ip.com/v2/free/127.0.0.1
	Nemty.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/84.17.52.2/countryName
	227.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/102.129.143.40/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	OJa1BOigU3.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	34.117.186.192
	OJa1BOigU3.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://reactivate-account.live/	Get hash	malicious	Unknown	Browse	34.117.186.192
	wNyot4Puq5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.186.192
	SecuriteInfo.com.Win32.Malware-gen.14907.28959.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Win32.Malware-gen.14907.28959.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
db-ip.com	OJa1BOigU3.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	104.26.5.15
	OJa1BOigU3.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	RY5YJaMEWE.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	OUZXNOqKXg.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	0BzQNa8hYd.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://u.to/rh6dIA	Get hash	malicious	Unknown	Browse	34.117.121.53
	MDE_File_Sample_1fd07379ca528bc6536b2053dddc3ea7bf85e268 (1).zip	Get hash	malicious	Flawedammyy	Browse	34.117.188.166
	OJa1BOigU3.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	34.117.186.192
	OJa1BOigU3.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://reactivate-account.live/	Get hash	malicious	Unknown	Browse	34.117.186.192
	wNyot4Puq5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.186.192
	SecuriteInfo.com.Win32.Malware-gen.14907.28959.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Win32.Malware-gen.14907.28959.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	34.117.186.192
	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
FREE-NET-ASFREEnetEU	OJa1BOigU3.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	193.233.132.253
	OJa1BOigU3.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.226
	9vZbHuuOq6.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.253
	ABD88D155FC99F529EDC0F725A4151C61126B7890BC6B.exe	Get hash	malicious	DCRat	Browse	147.45.44.3
	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	147.45.47.93
	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	hYrJbjnzVc.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
CLOUDFLARENETUS	http://url2702.birdlinesurvey.com/ls/click?upn=u001.fvR7TaIBWduFhQsheFn3aEaPhK8uODx4FECc3zInjq9BSAf6gBrj2-2BedXmzSOWcd7vxp_lhEpvcamcm95WhC017PRgUW5-2FexFmUztzt-2BcKquNxQ1YN72CKbQQSny2VeQqNZrhBFTOEqx-2F39TrKU7BM5IdEMb8Ff5ZieEcgOxfUarcqJlesyk2zJY-2BwChBwanXRRguoubpfSPqJUGeBH-2BzQeyYA0nqbzb6SKnXlWMM81gllISMtxtUwBSKbkxJz93WcSM4hTla0Kc1ku7W5WS7mebxSuTWlLTTC-2FhqXapGO2vZ08oTfJZVndvi6I-2BSnihO3dZsSJgENxwP5ZhoejGfPPs1Na-2FVC2UyFhZFyHjm0X4TH2XjgB8AYX07PdLxDOeoeWyiOnumIU4-2B-2FgJov9FyGEDMwPThdsm2z08qXDtfdx0QY6k32zVGOZMjxPkju1pYu-2B-2BIuSn1OLU8E2ck-2ByrYb4gXHvkd08o-2FHpdsvgFBnmLtYDeKd7vxr1IhtyjP-2F7suT-2BOfLMWrgiPDFhYVGGNB34EPhojLkUDKyEX35z0JUhT-2FSaPoSfbYVLUvzNDpg8UZ48DeSGARh29mUxJgFc3uzTCxyTF0Fpnvt7ZJKajvB7kNsGeaoRFHFpUHzNVsrYK1-2F1wGrAVj4ZEp-2FG58qkwpBzPAruseXEAU6-2B6hEfYNMONrNvIY3vz2ha-2Buhz-2B1j3r-2BlhJV3MJvwCHsnDS-2BEQb3ae9OABVw0ZkVBjYVDB8BpSYCBmu3oAOjJJvgg9foyeOeKFSaqitIV8XTM2RDg8SEHJb5Q5pucXuEGbqophNoPNxxiUg1BeM9YM9XQ9Q8TMcWw37s3qSJtDR9CV6L0GplPi-2Bq6Z9-2FD8pF7r-2BPjSP9fvF9bsB0rEgBa7-2BFpP02oFrZA82EmV0vtJFdb5DlGrcdYINE3Rc0UBEelzIaogt1DDEMdOA-3D	Get hash	malicious	Unknown	Browse	162.159.137.9
	http://email.panatech.io/c/eJykzbFuwyAQgOGnwVstOExiDwypIqaqa6pux3EppAZbmFRKn76K_Ajd_uXTH-x1UHBQHVt1VEZKMFJ10QL5idF4CqO-TmoMo2YmDBTkZMirLlktCaQxR5g4sISBWaNUo4HDQaM-ghjkigUbU-zT0s02trZuQp8EOAEu1p5pKUtO1FLmrU8lJNyTlizAcZv7Na5Cu3udhT7_1-8u3DJmbJjvWyKPBSs-rQBHX_nJENzj82JOlNXv2-X9x3-8Rp_nmR7m5kEKfe6q_cbKRQyy5u2FlrxiSfv3LwAA__9Tq2zK	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://www.ismg.com.mx/	Get hash	malicious	Unknown	Browse	172.67.185.53
	Scanned_From_Microsoft-365-Ms Jennifer Ferrier Chief Financial Officer payment remittance.HTML	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://secure.rightsignature.com/signers/a62bc9d4-e300-4799-b31f-1baf2136c0d1/sign?identity_token=ikxrhixfmvyfgisdycV9	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	https://bio.site/1stghmcom/	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	TS-240506-UF2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	SecuriteInfo.com.Win32.PWSX-gen.32248.12145.exe	Get hash	malicious	RedLine	Browse	104.20.4.235
	SecuriteInfo.com.Win32.PWSX-gen.6752.20282.exe	Get hash	malicious	RedLine	Browse	104.20.3.235
	SecuriteInfo.com.Win32.PWSX-gen.30686.12876.exe	Get hash	malicious	RedLine	Browse	172.67.19.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Transfer copy of remittance.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.5.15 34.117.186.192
	#U00d6deme makbuzu ektedir.bat	Get hash	malicious	DBatLoader, Remcos	Browse	104.26.5.15 34.117.186.192
	#U00d6deme makbuzu ektedir.docx.doc	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	https://i.nupem.ufrj.br/SYE_6SKEh	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	BB6571B3.xlsm	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	OJa1BOigU3.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	OJa1BOigU3.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	app.exe	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	Template_signed_0405.dotm.doc	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	SecuriteInfo.com.Variant.Lazy.387025.32273.29448.exe	Get hash	malicious	RedLine	Browse	104.26.5.15 34.117.186.192

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3188736
Entropy (8bit):	7.981027272062894
Encrypted:	false
SSDEEP:	98304:DInXnNqIvqO74jZlyPeYy+sOnc6FqoMD:ygISO7sZae+FcSMD
MD5:	51014F1C86736D8F91D432548062EBBF
SHA1:	6D0BAB0A443FF43C293F57DFACE65DFEA47501A9
SHA-256:	1845D2A25B628C6FF5E489F83FF975A0C8140BBEEB8EA05F5404A45EE2F9C7EA
SHA-512:	E05A72A5DEDE84005AEDB80884CE191180BFD811A5AA197E18B5D467170B1E6B534B42EEF3F37782355193663F952599D7EB6D0121A6F1ADB2019CB3B547187D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39% Antivirus: Virustotal, Detection: 40%, Browse
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....96f...............'.........................@......................................@... .. .... .. ..........P.......\...............................0........................................................................................................6..................@........................:..............@............P...P.......<..............@........................D..............@................p...b...D..............@....rsrc...............................@..@..........x......(...p..............@....data....."......".................@...................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_f22e2bf49a32bf74f5adbe8cba848017948e65f7_0010bad0_640263cb-49b4-41b7-b487-4b818315d5ea\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0905694034302293
Encrypted:	false
SSDEEP:	192:+CRlrSzZ8DX0N/QB6E6jjYZrSruBl9zuiFGZ24IO826t:BKZekN/QEjC9zuiFGY4IO8p
MD5:	AA33BA4BF670C5953A2F6849F09214EE
SHA1:	9654FA3E4E28A7A5EC9712BD477049F87717B9BC
SHA-256:	60351DC8F18704950DA6429CDCB7657CF90F1FD55EBA315194453D155F1A7904
SHA-512:	667BC52BE4258C36A5ACD14726F8841A8C276546B9E269DDEF15F85AEDBF8019134420E3C82870C1B7F1C613AD4DF17C7126C6C1C9329D47CFE56BA909DD8853
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.4.9.2.5.2.3.6.1.6.6.8.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.4.9.2.5.2.4.1.9.4.8.0.3.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.0.2.6.3.c.b.-.4.9.b.4.-.4.1.b.7.-.b.4.8.7.-.4.b.8.1.8.3.1.5.d.5.e.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.6.d.0.b.0.6.-.3.3.0.5.-.4.8.8.2.-.9.8.3.4.-.f.8.8.3.7.c.5.e.f.e.e.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.a.0.-.0.0.0.1.-.0.0.1.4.-.8.8.1.5.-.6.f.5.0.e.0.9.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.6.d.0.b.a.b.0.a.4.4.3.f.f.4.3.c.2.9.3.f.5.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d8cfe4b0b9575b2ab71f14e55e4d6484872cb94_df5fde7b_aa9d6a92-8d2d-4559-99fe-1b134b7dfc56\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0964596449196107
Encrypted:	false
SSDEEP:	192:q4Es50W0MpLFgjYZrSruBF9zuiFGZ24IO8ilp:2s509MpLFgjC9zuiFGY4IO8ij
MD5:	C31F66AAD3C803A9195EE514D87571F5
SHA1:	3CD88A966E201D2B26E21456B1A9D2A4E4C1B92B
SHA-256:	91757B335D88B354A602F9841711687C8233E333C2211AE0B6D2E070D8990066
SHA-512:	0A1DF693A8AA45C2EF00B40EB6CBF35887AB0B119E85C15ED8927376B6EAE23BB2FF7557557C17BBD55222C0AB307685B34F0DDBB790B5D9F3B242043AB389B5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.4.9.2.4.9.6.6.4.2.4.1.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.4.9.2.4.9.7.5.9.5.5.3.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.a.9.d.6.a.9.2.-.8.d.2.d.-.4.5.5.9.-.9.9.f.e.-.1.b.1.3.4.b.7.d.f.c.5.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.1.0.f.e.e.f.d.-.f.f.d.5.-.4.2.c.8.-.a.e.b.e.-.b.d.8.c.a.f.a.9.6.b.8.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.f.8.-.0.0.0.1.-.0.0.1.4.-.5.e.3.e.-.d.c.5.4.e.0.9.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.6.d.0.b.a.b.0.a.4.4.3.f.f.4.3.c.2.9.3.f.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d8cfe4b0b9575b2ab71f14e55e4d6484872cb94_df5fde7b_f3afe759-c551-431a-a54b-014b05a40ae0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0899393167777214
Encrypted:	false
SSDEEP:	192:vBUnW0W0MpLFgjTZrlyLB+EzuiFGZ24IO8il:5UnW09MpLFgjNEzuiFGY4IO8i
MD5:	2CA776CB2C6318C667E984C174AFB133
SHA1:	4BC3A2B560AAB09D12431FFA495939F944C53DA6
SHA-256:	6C7F40749FECF3111C83ECF8FF43F1585FACB4C409D8F831B06498E4456DC3EC
SHA-512:	BA0D5D03296950334485F6745266A106D48F2BDF87415E3DBBC24CB710DA3F14C3618D24EC89DE4ACD00512A45DDD4639E7272BF38A230706F42F0E03A291F7E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.4.9.2.5.0.0.1.5.8.8.7.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.4.9.2.5.0.0.8.4.6.3.9.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.3.a.f.e.7.5.9.-.c.5.5.1.-.4.3.1.a.-.a.5.4.b.-.0.1.4.b.0.5.a.4.0.a.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.3.3.0.3.1.5.d.-.7.f.3.c.-.4.1.f.8.-.8.9.9.0.-.7.7.d.9.6.2.3.4.b.1.5.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.8.-.0.0.0.1.-.0.0.1.4.-.4.9.3.4.-.a.e.5.9.e.0.9.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.6.d.0.b.a.b.0.a.4.4.3.f.f.4.3.c.2.9.3.f.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_751fa919568148cae58711204775ef674bafd71f_50e30abd_2c1d9ae0-1b69-4126-ae64-d738448a55b5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0843647047578129
Encrypted:	false
SSDEEP:	192:rPBlVv2PXh07VKrI3jxZrBruVzfzuiFGZ24IO8iB:Vf2vi7VKsjwfzuiFGY4IO8S
MD5:	9CD05F7201C84C3EAE853B7F6D11EB79
SHA1:	C69913D9107A9550DCD24C8FBAAC87EA493CD6EE
SHA-256:	7E562B75DF4D1B182C40666680F5773D52382E02AF2EE8C97C5C22A18B7DE357
SHA-512:	AF13F61976C03AE2758B6801CDC93FF1C6489C273804DCA22BBF2825FC69E0014CA86608568E697D4B11FDA4B27D7066FA22464DD7B8C86515CB51B7D51B2291
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.4.9.2.5.0.0.4.8.2.9.0.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.4.9.2.5.0.1.0.2.9.7.8.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.c.1.d.9.a.e.0.-.1.b.6.9.-.4.1.2.6.-.a.e.6.4.-.d.7.3.8.4.4.8.a.5.5.b.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.d.f.3.2.1.a.-.d.3.8.9.-.4.b.1.a.-.b.c.e.2.-.7.7.6.6.a.6.c.d.e.e.4.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.0.4.-.0.0.0.1.-.0.0.1.4.-.7.9.c.a.-.d.0.4.e.e.0.9.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.6.d.0.b.a.b.0.a.4.4.3.f.f.4.3.c.2.9.3.f.5.7.d.f.a.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER144F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon May 6 18:08:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	129244
Entropy (8bit):	1.8664892656470333
Encrypted:	false
SSDEEP:	384:R4IKedBfue6DB09Rj/MAaC/ak3eC36irjRv4AtqoT6PdbeJ5A3XziCG46Mh:KeHfue6DBUjDjswRv4xoqdKn+XMg
MD5:	F9F6B87B2052478E4B155A5705524DB8
SHA1:	B75BBB89FD21007880E55E5856E8B2FCC1811953
SHA-256:	418E0D7556EC9DC5E72AA0825EE4B9828DB616C32510FC77B91B512FCAD2491E
SHA-512:	541714E05BDB62BAFE8FADE90FDFA08EC6C3737E083E2A6DF989BE7B27C205D5FA3F131C1AA6E63D6FF24449FD3E43953E393BDD51C24285884F5343656C06EF
Malicious:	false
Preview:	MDMP..a..... .........9f............D...........H...X.......l....%......$....U..........`.......8...........T............M..L............&...........'..............................................................................eJ.......(......GenuineIntel............T.............9f............................. ..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16F0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.7025230006291654
Encrypted:	false
SSDEEP:	192:R6l7wVeJ6t606Y9VSUj3gmflJJRoprZ89biXsf0eGWm:R6lXJo606YvSUj3gmflJJRbicfS
MD5:	E6961886BC4A7B550AAF54ABD3849F11
SHA1:	F2C3E87EC9F01A616259B4F9C66866740B82CAEA
SHA-256:	1200C767DED18A9A0C8B1D9090F1D70141D3310BDA28D86C9ABF9C5FB42AB6CD
SHA-512:	8D6B440DAB44E3295104A062DD72ADF3809B3B89B357C9DB838FC47368EABE650333FFB19C5AEE2D39EC8E35FF91585963BACBBBBD5F8FAAFDF14E4B549DE241
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER172F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4718
Entropy (8bit):	4.510283429940356
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg77aI9joWpW8VYmYm8M4JSfFqdQu+q81e0Tvz9effd:uIjfnI71B7VuJ0uKlend
MD5:	9A41A724EBF1E9CC1E1D6FC1FDB3DBBF
SHA1:	6BD16B91535283A61E6EE7FD473D288ED132F94B
SHA-256:	D5B8DDF8CB785699A78F105CFEA83D7E32CEE824ABC7C15318CEA00FB2189DD1
SHA-512:	36E323F23DABC97E2E6AE0422BE518EB4F15A8565F43FA1FE89184A0EC99F52A7C23BD6FAC57E5938C69D9216F60E8402028E1CCE3E3121601CA3855B1B22343
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="311590" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER220B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon May 6 18:08:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	127924
Entropy (8bit):	1.8698917211657768
Encrypted:	false
SSDEEP:	384:51jiWdU0lISe6UuyEafkiToPX/XMmENHNiHLD5rwWKN/3oPH:GW+jSe6UuKfkaVKX5kWk3o/
MD5:	C8550F84FCB3CC9A144BC3D89C405C3C
SHA1:	F51039719BC58DB77F103C6775CE38CCEED458E1
SHA-256:	CAEBC1E69932E0B4BBCDD9ADAD22830F460A0CF7369BA720E24A924E935A9A69
SHA-512:	8C2F1C562E6DA9AD03ACFDC444F2ACE0FF05B5DF35330F3C5571D755DAE0341DF640E0FD96E715D9D078A2A14FE6CCFABC41822B76BCF5FABA76EC9735FBF3E4
Malicious:	false
Preview:	MDMP..a..... .........9f............D...............X.......l...4%...........T..........`.......8...........T............K..............%...........'..............................................................................eJ......$(......GenuineIntel............T.......h.....9f............................. ..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2333.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon May 6 18:08:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	128722
Entropy (8bit):	1.8718952625692038
Encrypted:	false
SSDEEP:	384:KOhkAVdUFE4suu69LBqtL0GPrh1LG77G8r+kp6N4WoErtFFHjy2lx03a:XV2FEfuu69ItbjhVG7lZw/Jlwa
MD5:	3FDD9DDD24F867247F550D79576492B5
SHA1:	CBB6B106E4E9A38AC7F27442A390EB76394D4516
SHA-256:	4BD6E64F1B061E12233D81586387E019CDCA3983F4EE4D40D9D0C30AEB570672
SHA-512:	CC514C666E3BF56F59EAC186B0298C1AFAA4814826382F1C9D5A9588DAA4C77D40006954C777DD6E5CF27EC722051B5A1323DCEDC7D6153544E7EFF536E3FEA0
Malicious:	false
Preview:	MDMP..a..... .........9f............D...........H...X.......l....%...........U..........`.......8...........T............N..............&...........'..............................................................................eJ.......(......GenuineIntel............T...........v.9f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2334.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.7010156450821152
Encrypted:	false
SSDEEP:	192:R6l7wVeJKN6r6Y9YSUb4gmflJJRopra89bOOsfTam:R6lXJY6r6YSSUb4gmflJJRuONff
MD5:	35D2004C8B1C4F58AF70EDAC2D347B77
SHA1:	C6DE8C24B7B7A32F81759DF12B072406EF95A652
SHA-256:	04CE5EB49FBA8D9C7F4A6F34D0CAF04B0697697D6D0B3BCAA073528AAC159919
SHA-512:	DFFC4F48A1E8A69D024D02368D207E6FF5EE6CB1E4116B28128DA5AC1EB831CDF571ADE17C532C3353BE1E65D1D9A11A114777DC9C32E6DAF1C5FC8FF94C69FC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2364.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4718
Entropy (8bit):	4.5132178215338925
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI9joWpW8VYSYm8M4JSfFo+q81WTvz9eQfd:uIjfsI71B7VyJpfleed
MD5:	224398A0D108958FB7ED8230FFE3B5EC
SHA1:	BF6C7E2EFDE59198909C1502CB36C819704688A0
SHA-256:	472A7539216723B5D1F7C8AFA77AF595C3104DCDA0CDEF7103A208A79A51AC76
SHA-512:	5C2B34CBD28B99FFCE63BCD5B168F3E9C8B719A9499E91AD66C433128C9F6E838A8CE84EB6B1E5675775F8176B54A83A3E92DE454813F0E2AAA6735E1581E8A8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="311591" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER242E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.6983318919204144
Encrypted:	false
SSDEEP:	192:R6l7wVeJrCG6rE6Y9dSUcZmgmfBtJJKprZ89bOOe0sf3am:R6lXJv6w6YnSUc4gmfrJJpOnf7
MD5:	C9E49EE149F5CE16D9DC0F377D895655
SHA1:	4FE1A3DBA67C58A31C6330AA8B3951A6CC37F3DD
SHA-256:	37CE4B8B644B3DFB082DC6BF495E23BBBB1C3632642EB5F2673DFE90F9DDC858
SHA-512:	72EA2E1253A4760A758DDB1C72014EE2E335C35862C0B5379981D75A330027227243F1E6CAC04C61CE7D956E82CFB1DAB8B58712011F4404B358969EA1224CCA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER245E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4693
Entropy (8bit):	4.492181588108718
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI9joWpW8VYlYm8M4JwwhfFA+q8qhskTvzCn/fd:uIjfsI71B7VRJyfKnHd
MD5:	D458114B6F7E01BD639DF7FEBB4916CB
SHA1:	51C5D93ED0FB43D2D48ABF19675D4ADAF9B822D1
SHA-256:	866CDE98BFD62F6BF7A6C22D5E1F0DE64847B93C3AC6F985D236B3DC5265A37F
SHA-512:	06AA5AADDD6B7FA5803B832D1676B3DE09BDA661F99434198CA3CE34F9DC5A49436A1DA86CDD07372B1E278B93D8247286596B10C78C1AE97C0BEB1644540FFC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="311591" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D98.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon May 6 18:08:43 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	124194
Entropy (8bit):	1.8790490714345165
Encrypted:	false
SSDEEP:	384:+04+dlGue661ofmc58qELqtdiNcpBefBrt6RJ8TG0ROuf:8+LGue661ofzWqnycpOr+b0RXf
MD5:	666AD78D41360D232AFBD74E5088E4AF
SHA1:	8D3C807B86443A474F50855BB2293B8043912961
SHA-256:	784D43CA6CFD82D5923C30E95CE46BD122B0E6CA8533A0A6B4EF2804D8A3918A
SHA-512:	0494860663F59C75D99EE3F5D1D9DBB27B3A58D1B6013A5390165623EEDBAF94CE2BA7AACDEDDEE22828DB1F022DDE5EC22030F9E35B255CA61205726862CF0E
Malicious:	false
Preview:	MDMP..a..... .........9f........................H...(.......l...p%......4....R..........`.......8...........T...........xL...............%...........'..............................................................................eJ......`(......GenuineIntel............T...........y.9f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E83.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6384
Entropy (8bit):	3.7273716578467684
Encrypted:	false
SSDEEP:	192:R6l7wVeJfuJ6ntYiPJJcprB89bjnsfrqBm:R6lXJw6tYgJJPjsfh
MD5:	3919D0B5A08663536B506AE5758B9FFE
SHA1:	1BDA3AF002C47E682A7F1A718A7FFA4C21B42ED1
SHA-256:	C8533F1FAAD22712B4F70CD978122BF7705BDB47F0234AD1FC7A5FED095C55C6
SHA-512:	A6E05F0DFE3D61F17C4F285400BEC7C6710458A282D29480CF4D2BF1384F9F160DC8FD7FA456F25E379012E5150C36F21CBA27804AD30FC11620E78C7B9F3A53
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7EB3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4713
Entropy (8bit):	4.521361199821821
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI9joWpW8VY6Ym8M4Jk8zFP+q8xY1/TvzxkNfd:uIjfsI71B7VWJHNaU/5kRd
MD5:	F3BACA1D7789E4C51527FE225FB036A0
SHA1:	F707346942747E8E7C267084DC68792C5DCA7DAB
SHA-256:	740CA628ACD3BE0AB96F77E0A287931992B7D6364322F4DB5B711385BFB8348C
SHA-512:	3601C028B3B832EA997FBA6ADC10520F971BDE1CEEFB51FB5CD77B3BD421B8DABF2030671E336E8440CDF5B3609F1026E725B0160B4BDD20BD1F358A5E3ED54A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="311591" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3188736
Entropy (8bit):	7.981027272062894
Encrypted:	false
SSDEEP:	98304:DInXnNqIvqO74jZlyPeYy+sOnc6FqoMD:ygISO7sZae+FcSMD
MD5:	51014F1C86736D8F91D432548062EBBF
SHA1:	6D0BAB0A443FF43C293F57DFACE65DFEA47501A9
SHA-256:	1845D2A25B628C6FF5E489F83FF975A0C8140BBEEB8EA05F5404A45EE2F9C7EA
SHA-512:	E05A72A5DEDE84005AEDB80884CE191180BFD811A5AA197E18B5D467170B1E6B534B42EEF3F37782355193663F952599D7EB6D0121A6F1ADB2019CB3B547187D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39% Antivirus: Virustotal, Detection: 40%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....96f...............'.........................@......................................@... .. .... .. ..........P.......\...............................0........................................................................................................6..................@........................:..............@............P...P.......<..............@........................D..............@................p...b...D..............@....rsrc...............................@..@..........x......(...p..............@....data....."......".................@...................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\9wBRx7ST9VOnJqni_JpioUs.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5526
Entropy (8bit):	7.899067442079574
Encrypted:	false
SSDEEP:	96:VTbWGzqeAoMq+YK0KF8cAJiI2i+uvUmGsFQT0ozoPCMHz3KJY9LpO:NqASpF8wF+hFQ0koPl6Jb
MD5:	5FC9973F4733EB3DA520CD2B5F842AC6
SHA1:	56834308A0D9A532070C01D8D6AB59539A6DE240
SHA-256:	CFCF7416481CB10ED8D5A2B87DE7AC638BEA81AD3DD5B498BD26B9185C0FD28D
SHA-512:	97D52200FB94EDC3A06112AEF3F7B917053A42E02E4D2139CB804B65B365F90593E437BE6155139411B7D9BF29B788F0F35F1EFE2EA6BB8F56412074363217C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\9wBRx7ST9VOnJqni_JpioUs.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\PSdiYEtw_DOSPKoK_uBheap.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5593
Entropy (8bit):	7.897308670656991
Encrypted:	false
SSDEEP:	96:WYWGzqeAoMq+YK0KF8cAJiI2i+uVrV0C/SAcrQb1o8ygX3KJvx:RqASpF8wFqa8SP8v6JZ
MD5:	EAC7219D7514E3DB624FD2DFA63C5985
SHA1:	AC7D38B5171840603101CF3BD8ABC604FFAEEF63
SHA-256:	D86D27A46CBC1DD538D02498EC5E03BFDB71DFE5F294EDDA9DA33D354EC94895
SHA-512:	063768A2A0CE9ED77CAD8AF74D4C89FE37CD2AB11AB7557C21AE90FE189F3C7F92802395799FD67A92C136C1F45A5BD5BA7BD9E5B62E7187B6579F1B710920DD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\PSdiYEtw_DOSPKoK_uBheap.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.71929452566698
Encrypted:	false
SSDEEP:	3:LXRJQn:bRen
MD5:	1FCDAF381F15F605ABAAFF8DE3887A8B
SHA1:	6940164F10801D9DA5792A4DDF59C4FAF2063B64
SHA-256:	46EC0FC8056E99872F7040240226EED9F44C4BEF644630C1F7B06C8F88DC4514
SHA-512:	4CFBA1A1A825C6EFAA0FE90C27CE924381F975E6A17C80A6495BBCC3A39AD6A9059071898632C61FCF8055082391C8A473ADDC62D1C501F8FA572A4488982071
Malicious:	false
Preview:	1715022640625

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\1bA0iPxs1_tpWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\7Ndzc20NqBT6Login Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\LjKc4cZCdkn6Login Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\N00nD6NyQ3cLCookies

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\NxTOOE3P877HHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\QALFCGqIe0GzWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\QZolPj_wU7yvHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\S9TwIATY7544Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\Y4Fgx64HQvbuWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\a7mDNvwnbxnHLogin Data For Account

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\erLXBsfZOb13History

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\m736MhFnnhWLWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\ru4TymmQRM2zWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanHju_g2DxItFq\vd0z8wzGefD1History

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\1TlhGNMGRIBAHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\4deeADJYPmpQWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\8ZyHikzPP6RfHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\Ip1jITBVvpfpWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\KD92s1mFJPJgLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\K_LAuSWvaNiyWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\LhmhqtkXTkbYHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\N6snpryO8uf5Login Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\OXHUVahmxrt1Cookies

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\TLE_gXdWplrQLogin Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\UqNl41FdpO7sHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\Y7ezkClN3tvGWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\c_G5qyHoUqdbWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanMW7ZIM5Bq6VF\sQSDtQYbXNYdWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\0bTBLNjSXQ3WWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\BhPLdlMH4HviHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\DOGuPW8VgXDwWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\Hveaex_QIWEUWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\S1kWLfoUHhbSLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\Ss_aLcG4kfDuHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\Z82s7O924lLeWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\ZhaKbTXVRlMcLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\iCl1DNg_vvFNHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\ruxveYYrnNxbWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\suF4nwudmtWhCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\uxiBTU0fcTIoHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\yabQsRD6rxEWLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanVDXBLDHnzSSM\ycP9pvgLeKxDWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\42h4yDt09kAFWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\ELASOvMcSsNrHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\HQFayTHWA4CIWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\OAwfuvRJ7Zo3History

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\OrF8rFJrkbX9Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\UaBkH_1UtTljHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\V9veGYQ701aZWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\cCZagzzOxnzSLogin Data For Account

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\h7vTUP6iIQXbLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\kGWzVJBhnyHSCookies

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\l9WMfadWVY3RHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\ne2K7r4K6MmbWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\pSuV50rXNRR3Login Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spansEwF_O0f6T2F\pTWMc6sLNinTWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tC131VXqxqwXyoqOe7muh9i.zip

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5574
Entropy (8bit):	7.898028478345893
Encrypted:	false
SSDEEP:	96:RWGzqeAoMq+YK0KF8cAJiI2i+uZ7czpYizCaGnwdUUt0S3KJ2G:VqASpF8wFOIzTfZdUUOS6J2G
MD5:	181A27FA5AF5932F05CBA9FE173536AE
SHA1:	E2FA21601E1FFC2FEE7270F173EC6E3D6F835E12
SHA-256:	1FB0A2B4677EC01D15EEE4828D78D6DFEA081F662AF47AB74F7A628DF82BDC5B
SHA-512:	4BC872A05C20C7BF8D5F8DF2300799CAD9FB30363C91A95B6636E999DE0D4236DDAF8CE73007C34F5FB0770CB8F5D8EF878EF19419F6823522651C11F6F15A36
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\tC131VXqxqwXyoqOe7muh9i.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\trixyHju_g2DxItFq\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyHju_g2DxItFq\information.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6597
Entropy (8bit):	5.381904966077102
Encrypted:	false
SSDEEP:	96:xdQ4zn5RoEcT4Aisph+9hcmpN8Xa77Y6lANUbg3x:xqECEvAtphWhcmpN8Xa7sB
MD5:	0E695507ED2A8C5FF8124A8AF693AE01
SHA1:	01CED25903043763C9CE64EEA02556A7B3D43ED7
SHA-256:	3E790E17AE8188098232BE6EF2FD222C7DADA28AFA96EA285624BE80047BDF63
SHA-512:	C860C7D495E6A21BCCCCCFB158F416CE8B520806C39C114A6242D3B1B74D000C2540F92822FCC198A614D857E1B73AB4F8439E8168C8BE5C3089F7BFE6B1FFE2
Malicious:	false
Preview:	Build: domen..Version: 2.0....Date: Mon May 6 20:08:16 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 7e55834bc82db041109988ce9c6b5293....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyHju_g2DxItFq....IP: 84.17.40.101..Location: US, Miami..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 936905 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 6/5/2024 20:8:16..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvho

C:\Users\user\AppData\Local\Temp\trixyHju_g2DxItFq\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyMW7ZIM5Bq6VF\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyMW7ZIM5Bq6VF\information.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6576
Entropy (8bit):	5.373448179428926
Encrypted:	false
SSDEEP:	96:xdQ4zZ5RoEcT4Aisph+9hcmpN8Xa77Y6lANUbg3x:xq4CEvAtphWhcmpN8Xa7sB
MD5:	930E032F5DEA77A44698333A52DEFB69
SHA1:	A74D3CD49EC58C26376E4BC88414306DD76B822D
SHA-256:	3B9826CE5FA664406D0C5F2910C50361C4533B3696B41F74FA8EC0D4A7450DCF
SHA-512:	BC62D5CA2610E9E8112676798CF8C7D7010AC32E77FE2B79C4CC1DAD1CFE7E7FC0343914D2EE4603E5AC5A4CC3B5DEE89033D9D7A67E0A078AAFEB8D5B6CFC50
Malicious:	false
Preview:	Build: domen..Version: 2.0....Date: Mon May 6 20:08:16 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 7e55834bc82db041109988ce9c6b5293....Path: C:\Users\user\Desktop\file.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyMW7ZIM5Bq6VF....IP: 84.17.40.101..Location: US, Miami..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 936905 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 6/5/2024 20:8:16..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784]..svchost

C:\Users\user\AppData\Local\Temp\trixyMW7ZIM5Bq6VF\passwords.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyVDXBLDHnzSSM\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyVDXBLDHnzSSM\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6392
Entropy (8bit):	5.373770793597438
Encrypted:	false
SSDEEP:	96:xd+4zq5RoKLcT4Aisph+9hcBp18B77Y6YANUbg3x:xI3CKLvAtphWhcBp18B7nB
MD5:	A70CF1A3EB112594FC8FE6A68FF29338
SHA1:	7A9F13419E522DCE27508415D8A68F6A9F303B96
SHA-256:	F3EF57433D1876FDC9F35E989E076F3D2DCD1952FC512BADF4B604D69B03988D
SHA-512:	D44A121050C62FC25654BDE6CBDD803DA4F99203798DB319E0BC6D2AB279B7C2C2EC38BA52CB06B9F554D03BB8A0F4D4CEB0911D5A37F0BD921D38CADFC72130
Malicious:	false
Preview:	Build: domen..Version: 2.0....Date: Mon May 6 20:08:47 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 7e55834bc82db041109988ce9c6b5293....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyVDXBLDHnzSSM....IP: 84.17.40.101..Location: US, Miami..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 936905 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 6/5/2024 20:8:47..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784]..sv

C:\Users\user\AppData\Local\Temp\trixyVDXBLDHnzSSM\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixysEwF_O0f6T2F\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixysEwF_O0f6T2F\information.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6534
Entropy (8bit):	5.380724822250284
Encrypted:	false
SSDEEP:	96:xdx4zT5RoncT4Aisph+9hcmpN8Xa77Y61ANUbg3x:xf0CnvAtphWhcmpN8Xa7AB
MD5:	4692F874F5887889048A5CC75A6C575D
SHA1:	3E80F68927AC6B880354CEEA781A52414B7B5D55
SHA-256:	8B943BBEAD05DF539E4CDB02CA22303F15A02533214F22E52F1F43409B5A0786
SHA-512:	EA3C1FD136F950F48D8097DDEF5B390909EB59022ECCEB40EEBD7FCCF3AA385ACEE69F74FDF7253A4B90185A5685B91044F94AFA283E60EA1C687D427288DD46
Malicious:	false
Preview:	Build: domen..Version: 2.0....Date: Mon May 6 20:08:11 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 7e55834bc82db041109988ce9c6b5293....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixysEwF_O0f6T2F....IP: 84.17.40.101..Location: US, Miami..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 936905 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 6/5/2024 20:8:11..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvho

C:\Users\user\AppData\Local\Temp\trixysEwF_O0f6T2F\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wwigCWSFuz2MihL8u4G1uFC.zip

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5593
Entropy (8bit):	7.89976753757368
Encrypted:	false
SSDEEP:	96:WYWGzqeAoMq+YK0KF8cAJiI2i+uDMhsOxvTDmVX4S9Mn1fMCU+3KJvs:RqASpF8wFyOdDmJjMn1fH96J0
MD5:	70C14AE503DDDCAE4FA228AF8BEB2D70
SHA1:	472538B1E499DD288D16C55CC422D9F72CCF5CED
SHA-256:	CAB16CB61F3657D588911DEE8AB28B8C823AA00789EFA673D9C3CCDEED53F3A7
SHA-512:	14426973DD9DB408E13A963E79FCA6AD9C7DFC7AA7079F9C8DB7F38E1D931D5AC161D342504E07D3C4DCC7D8907025A44C2A2400627880ED60BDC43710EA4BAD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\wwigCWSFuz2MihL8u4G1uFC.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468993644417843
Encrypted:	false
SSDEEP:	6144:NIXfpi67eLPU9skLmb0b4QWSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbm:eXD94QWlLZMM6YFHU+m
MD5:	21AEF5DE06B1CBAD711E9B55A1CAC871
SHA1:	CE4E60F8C7C3EEBD3C18A016F573D03B17A31EA2
SHA-256:	79AFD7EF1C5BC30794DC038A3F0ACEE25635863BA6D9A649FF697F03F59A98C0
SHA-512:	12C808BB035224EA6486504C05348572CF91865CB9D1B65833EEEDB155E6B1B73C669105342C94B553F5C2B4F3949525B7F2B23D37F7566B5EC56373ECA98B4B
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.m.`...................................................................................................................................................................................................................................................................................................................................................T........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.981027272062894
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'188'736 bytes
MD5:	51014f1c86736d8f91d432548062ebbf
SHA1:	6d0bab0a443ff43c293f57dface65dfea47501a9
SHA256:	1845d2a25b628c6ff5e489f83ff975a0c8140bbeeb8ea05f5404a45ee2f9c7ea
SHA512:	e05a72a5dede84005aedb80884ce191180bfd811a5aa197e18b5d467170b1e6b534b42eef3f37782355193663f952599d7eb6d0121a6f1adb2019cb3b547187d
SSDEEP:	98304:DInXnNqIvqO74jZlyPeYy+sOnc6FqoMD:ygISO7sZae+FcSMD
TLSH:	80E533103553754DF91C23BB0B7E4BB213606CB76A520BE7926D391FAAEB5C876084E2
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	1e637808c76c1d83

Static PE Info

General

Entrypoint:	0xf5ca8c
Entrypoint Section:	.data
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x663639CA [Sat May 4 13:36:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	272279f18f704f637aa129691266b291

Entrypoint Preview

Instruction
jmp 00007F8A1D4E259Ah
add byte ptr [eax+0000000Eh], bl
add byte ptr [eax], al
pushad
call 00007F8A1D4E2595h
pop ebp
sub ebp, 00000010h
sub ebp, 00B5CA8Ch
jmp 00007F8A1D4E2599h
and dword ptr [esi+edx-357347C5h], 000300B5h
add eax, 0000004Ch
mov ecx, 000005B0h
mov edx, E63CE4B7h
xor byte ptr [eax], dl
inc eax
dec ecx
jne 00007F8A1D4E258Ch
jmp 00007F8A1D4E2599h
cmp eax, 3CBFE389h
jp 00007F8A1D4E25CEh
mov esi, dword ptr [edi+7636B7B7h]
dec edi
mov bh, B7h
mov bh, B4h
jp 00007F8A1D4E25A1h
mov cl, B7h
mov bh, B7h
or eax, B7B7B79Fh
inc eax
push ebp
mov ah, 7Fh
cmp al, 36h
mov ebx, B4B7B7B7h
jc 00007F8A1D4E25CCh
rcl dword ptr [ebx-6C4CC1B5h], cl
cmp dl, bl
xchg eax, ebx
dec ebx
mov bl, 93h
fbld [edi-20486910h]
retf
xor al, 23h
mov bh, B6h
wait
xchg eax, ebx
fistp qword ptr [edi]
leave
sub bl, 0000005Fh
mov dl, B7h
mov bh, B7h
pop esi
xchg dword ptr [edi-2CC54849h], esi
xchg eax, ebx
dec ebx
wait
xchg eax, ebx
cmp bl, bl
xchg eax, ebx
mov bh, 3Ch
xor bh, byte ptr [edi+3CB7B7B7h]
and bh, byte ptr [ebx+3CB7B7B7h]
cmp ah, byte ptr [edi+76B7B7B7h]
pop esi
mov ch, 86h
mov ch, 34h
jne 00007F8A1D4E2545h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x940050	0xd0b	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x940d5c	0x3b0	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a1000	0xc8bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x940030	0x10	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x940000	0x18	.data
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x15c000	0x93600	1c30c55f327dff326a32a79b19e348d6	False	0.9999685247031382	data	7.999675017725288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x15d000	0x28000	0x10200	74548ae799e79fc20306cc602d37a794	False	0.9983648255813954	data	7.99639087266641	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x185000	0x5000	0x800	3818ed903188218960f33e014f774303	False	0.9970703125	data	7.83802229172669	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x18a000	0xd000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x197000	0xa000	0x6200	190e1a61abc7d6a0a7c981417fcc65a3	False	0.9881616709183674	data	7.972593331740996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a1000	0xd000	0xca00	6e46563fc615b7272cc3ab7b669e3874	False	0.6000541460396039	data	5.556770173829542	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x1ae000	0x78f000	0x32800	06bf0b39137a35cdc92c7a5f4bd29b27	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x93d000	0x221000	0x221000	09fd6339de78073bdda8de6df01391d2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a1370	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	Russian	Russia	0.31402439024390244
RT_ICON	0x1a19d8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Russian	Russia	0.42338709677419356
RT_ICON	0x1a1cc0	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	Russian	Russia	0.5061475409836066
RT_ICON	0x1a1ea8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Russian	Russia	0.5675675675675675
RT_ICON	0x1a1fd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Russian	Russia	0.46961620469083154
RT_ICON	0x1a2e78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Russian	Russia	0.4020758122743682
RT_ICON	0x1a3720	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Russian	Russia	0.45506912442396313
RT_ICON	0x1a3de8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Russian	Russia	0.2904624277456647
RT_ICON	0x1a4350	0x4b55	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.9921182266009853
RT_ICON	0x1a8ea8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Russian	Russia	0.316701244813278
RT_ICON	0x1ab450	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.36186679174484054
RT_ICON	0x1ac4f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Russian	Russia	0.42418032786885246
RT_ICON	0x1ace80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5026595744680851
RT_GROUP_ICON	0x1ad2e8	0xbc	data	Russian	Russia	0.6170212765957447
RT_VERSION	0x1ad3a4	0x398	OpenPGP Public Key	Russian	Russia	0.42282608695652174
RT_MANIFEST	0x1ad73c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/06/24-20:08:42.332746	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	147.45.47.93
05/06/24-20:08:11.803337	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49730	147.45.47.93	192.168.2.4
05/06/24-20:07:53.913307	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49730	147.45.47.93	192.168.2.4
05/06/24-20:07:57.036164	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49730	58709	192.168.2.4	147.45.47.93
05/06/24-20:07:53.682907	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49730	58709	192.168.2.4	147.45.47.93
05/06/24-20:08:04.120685	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49733	147.45.47.93	192.168.2.4
05/06/24-20:08:05.646832	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49733	147.45.47.93	192.168.2.4
05/06/24-20:07:56.321028	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49732	147.45.47.93	192.168.2.4
05/06/24-20:08:18.051763	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49738	58709	192.168.2.4	147.45.47.93
05/06/24-20:07:56.309289	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49731	147.45.47.93	192.168.2.4
05/06/24-20:08:11.640975	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49738	147.45.47.93	192.168.2.4
05/06/24-20:08:15.381006	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49731	147.45.47.93	192.168.2.4
05/06/24-20:08:11.897367	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49738	147.45.47.93	192.168.2.4
05/06/24-20:08:09.259896	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49733	58709	192.168.2.4	147.45.47.93
05/06/24-20:08:30.364347	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49732	58709	192.168.2.4	147.45.47.93

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 20:07:53.429881096 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:53.671523094 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:07:53.671605110 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:53.682907104 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:53.913306952 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:07:53.957776070 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:53.976671934 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:07:55.824038982 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:55.824769974 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:56.065807104 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:07:56.065886021 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:56.066797018 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:07:56.066957951 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:56.071782112 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:56.072952032 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:56.309288979 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:07:56.321027994 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:07:56.364065886 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:56.364069939 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:56.367609978 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:07:57.036164045 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:57.320930958 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:07:59.426615953 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:59.457962036 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:07:59.711488008 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:07:59.742330074 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:03.631109953 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:03.875864983 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:03.875960112 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:03.885246992 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:04.120685101 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:04.176578999 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:04.182113886 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:05.646831989 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:05.692157030 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:05.936779976 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:05.989051104 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:06.098227024 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:06.103302002 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:06.103332996 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:06.103409052 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:06.106945992 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:06.106961966 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:06.339298964 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:06.339395046 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:06.341357946 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:06.341366053 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:06.341618061 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:06.384519100 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:06.395313978 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:06.418107986 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:06.464109898 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:06.599848032 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:06.599961042 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:06.603946924 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:08.198303938 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:08.198335886 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:08.198354006 CEST	49734	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:08.198359966 CEST	443	49734	34.117.186.192	192.168.2.4
May 6, 2024 20:08:08.373500109 CEST	49735	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:08.373542070 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.373617887 CEST	49735	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:08.373917103 CEST	49735	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:08.373934031 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.604105949 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.604253054 CEST	49735	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:08.606523991 CEST	49735	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:08.606535912 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.606745005 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.607738972 CEST	49735	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:08.652112007 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.964488983 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.964575052 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.964665890 CEST	49735	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:08.964890957 CEST	49735	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:08.964917898 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.964930058 CEST	49735	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:08.964935064 CEST	443	49735	104.26.5.15	192.168.2.4
May 6, 2024 20:08:08.965241909 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:09.259840012 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:09.259896040 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:09.266164064 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:09.317173004 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:09.556468010 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:09.556528091 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:09.561661959 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:09.614058971 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:09.853571892 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:09.858696938 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:09.910964012 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:09.942348957 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.222027063 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222080946 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222093105 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222107887 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222120047 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222131968 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222142935 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222156048 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222155094 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.222171068 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222183943 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.222183943 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.222191095 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.222202063 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.222234964 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.466881037 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.466901064 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.466912031 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.466922998 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.466936111 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.466945887 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.466968060 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.467014074 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.508579016 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.780622005 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:10.832824945 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:10.832948923 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:11.096971035 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:11.145313978 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:11.166649103 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:11.403844118 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:11.403914928 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:11.423260927 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:11.640974998 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:11.660315037 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:11.660375118 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:11.754862070 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:11.803337097 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:11.848443031 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:11.897367001 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:11.928128958 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:11.928159952 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:11.928210020 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:11.934643984 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:11.934669971 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:11.957792997 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:12.030730009 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.030807972 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.030874968 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.031930923 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.031965017 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.040268898 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:12.089958906 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:12.145308018 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:12.159136057 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.159216881 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.160346985 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.160360098 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.160583019 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.207811117 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.208178997 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:12.211955070 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.256118059 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.258038998 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.258258104 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.259124041 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.259154081 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.259391069 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.301695108 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.354222059 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.400113106 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.425139904 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.425273895 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.425378084 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.425951004 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.425965071 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.425973892 CEST	49741	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.425978899 CEST	443	49741	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.428823948 CEST	49744	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.428886890 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.428953886 CEST	49744	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.429214001 CEST	49744	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.429249048 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.492665052 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:12.527859926 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.527955055 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.528141022 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.528348923 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.528398991 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.528429985 CEST	49742	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:12.528445005 CEST	443	49742	34.117.186.192	192.168.2.4
May 6, 2024 20:08:12.530188084 CEST	49745	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.530239105 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.530307055 CEST	49745	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.530841112 CEST	49745	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.530859947 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.658946037 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.659019947 CEST	49744	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.673862934 CEST	49744	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.673897028 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.674127102 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.682146072 CEST	49744	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.724117994 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.762039900 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.762128115 CEST	49745	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.763655901 CEST	49745	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.763685942 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.763940096 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.769131899 CEST	49745	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:12.812139988 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:12.972278118 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:12.972630024 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.015305042 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:13.015404940 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:13.015618086 CEST	49744	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:13.015831947 CEST	49744	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:13.015877962 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:13.015907049 CEST	49744	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:13.015923023 CEST	443	49744	104.26.5.15	192.168.2.4
May 6, 2024 20:08:13.016315937 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.149209976 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:13.149493933 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:13.149605989 CEST	49745	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:13.149758101 CEST	49745	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:13.149772882 CEST	49745	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:13.149816036 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:13.149840117 CEST	443	49745	104.26.5.15	192.168.2.4
May 6, 2024 20:08:13.150151968 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.217502117 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.217561007 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.217634916 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.217695951 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.281939030 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.332814932 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.348854065 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.428944111 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.473454952 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.473628044 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.509608030 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.607495070 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.660931110 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.676744938 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.731834888 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.785940886 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.801667929 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.937319040 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937342882 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937355042 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937380075 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937391043 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937405109 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937407970 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.937417984 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937431097 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937442064 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937443018 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.937458038 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:13.937462091 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:13.937490940 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.049913883 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.049945116 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.049957037 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.049969912 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.049983025 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.049994946 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.049998045 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.050009012 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.050024986 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.050040960 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.050043106 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.050055981 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.050064087 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.050091028 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.179074049 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.179122925 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.179135084 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.179155111 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.179167986 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.179182053 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.179197073 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.179244995 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.223562002 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.287239075 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.287256002 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.287271023 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.287286997 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.287292004 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.287327051 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.288132906 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.288149118 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.288188934 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.348608971 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.483681917 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.535952091 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.551644087 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.595041037 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.645426035 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.676739931 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.811254978 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.864070892 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:14.924233913 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:14.973442078 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:15.381006002 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:15.426573038 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:15.668236971 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:15.723449945 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:15.789808989 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:16.005717039 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:16.086106062 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:16.254055023 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:16.519521952 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:16.519551992 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:16.519622087 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:16.521846056 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:16.521857977 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:16.747419119 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:16.747498989 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:16.750204086 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:16.750212908 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:16.750412941 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:16.801619053 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:16.836322069 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:16.884109020 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:17.016320944 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:17.016421080 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:17.016469955 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:17.016669035 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:17.016685963 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:17.016696930 CEST	49747	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:17.016702890 CEST	443	49747	34.117.186.192	192.168.2.4
May 6, 2024 20:08:17.030910015 CEST	49748	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:17.030939102 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.030992985 CEST	49748	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:17.031574965 CEST	49748	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:17.031583071 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.266210079 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.273082972 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.273238897 CEST	49748	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:17.274282932 CEST	49748	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:17.274290085 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.274493933 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.275665045 CEST	49748	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:17.315606117 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.315679073 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.317223072 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.320125103 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.424546003 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.424546003 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.552731037 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.552743912 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.552772999 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.552802086 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.559081078 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.614103079 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.620683908 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.620785952 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.620932102 CEST	49748	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:17.622529984 CEST	49748	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:17.622545958 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.622576952 CEST	49748	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:17.622581959 CEST	443	49748	104.26.5.15	192.168.2.4
May 6, 2024 20:08:17.625957966 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.665880919 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.665990114 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.665993929 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.775163889 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:17.775182009 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:17.775325060 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:17.776518106 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:17.776525974 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:17.801681042 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.837224007 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.914395094 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.922540903 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:17.958020926 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:17.961594105 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:18.006872892 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:18.006979942 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:18.008208990 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:18.008214951 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:18.008440971 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:18.051572084 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:18.051763058 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:18.053730011 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:18.086612940 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:18.100120068 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:18.243196011 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:18.271575928 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:18.271703959 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:18.271750927 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:18.271996975 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:18.272007942 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:18.272018909 CEST	49749	443	192.168.2.4	34.117.186.192
May 6, 2024 20:08:18.272023916 CEST	443	49749	34.117.186.192	192.168.2.4
May 6, 2024 20:08:18.274512053 CEST	49750	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:18.274532080 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.274595022 CEST	49750	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:18.274879932 CEST	49750	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:18.274893045 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.338406086 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:18.501662016 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.501724005 CEST	49750	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:18.502757072 CEST	49750	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:18.502764940 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.502979994 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.503995895 CEST	49750	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:18.548108101 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.877245903 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.877357960 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.877521992 CEST	49750	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:18.877595901 CEST	49750	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:18.877604961 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.877629995 CEST	49750	443	192.168.2.4	104.26.5.15
May 6, 2024 20:08:18.877634048 CEST	443	49750	104.26.5.15	192.168.2.4
May 6, 2024 20:08:18.877863884 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:19.154187918 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:19.164650917 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:19.176702023 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:19.461040974 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:20.411114931 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:20.583075047 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:20.648225069 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:20.824548006 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:21.466136932 CEST	58709	49733	147.45.47.93	192.168.2.4
May 6, 2024 20:08:21.466567993 CEST	49733	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:29.276746988 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:29.276860952 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:29.337702036 CEST	58709	49738	147.45.47.93	192.168.2.4
May 6, 2024 20:08:29.337799072 CEST	49738	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:29.786101103 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:30.071582079 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:30.364346981 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:30.649070978 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311872959 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311894894 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311908007 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311919928 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311932087 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311944008 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311955929 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311966896 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311969995 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.311980009 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.311991930 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.312001944 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.312010050 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.312041044 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.343120098 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.395400047 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.396157980 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.553781033 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.553826094 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.553843975 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.553874016 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.553890944 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.553922892 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.553934097 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.553936005 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.553978920 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.614455938 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:35.679883003 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:35.898943901 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:37.977660894 CEST	58709	49730	147.45.47.93	192.168.2.4
May 6, 2024 20:08:37.977758884 CEST	49730	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:37.993565083 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:38.008991003 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:38.036005020 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:38.051628113 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:38.746395111 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:38.762131929 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:38.786000967 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:38.786046028 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:38.817337990 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:39.070677996 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:39.105950117 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:39.161000013 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:40.936675072 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:40.936738014 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:41.178503036 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:41.178525925 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:41.178563118 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:41.178674936 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:41.461266994 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:41.803118944 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:42.045099974 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:42.332746029 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:42.617496014 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:44.036108017 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:44.277954102 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:44.432712078 CEST	58709	49732	147.45.47.93	192.168.2.4
May 6, 2024 20:08:44.432768106 CEST	49732	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:44.634761095 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:44.634836912 CEST	49731	58709	192.168.2.4	147.45.47.93
May 6, 2024 20:08:44.680146933 CEST	58709	49731	147.45.47.93	192.168.2.4
May 6, 2024 20:08:44.680217028 CEST	49731	58709	192.168.2.4	147.45.47.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 20:08:05.762731075 CEST	63557	53	192.168.2.4	1.1.1.1
May 6, 2024 20:08:05.874954939 CEST	53	63557	1.1.1.1	192.168.2.4
May 6, 2024 20:08:08.260582924 CEST	58175	53	192.168.2.4	1.1.1.1
May 6, 2024 20:08:08.372803926 CEST	53	58175	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 6, 2024 20:08:05.762731075 CEST	192.168.2.4	1.1.1.1	0x6e54	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 6, 2024 20:08:08.260582924 CEST	192.168.2.4	1.1.1.1	0xc7ac	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 6, 2024 20:08:05.874954939 CEST	1.1.1.1	192.168.2.4	0x6e54	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
May 6, 2024 20:08:08.372803926 CEST	1.1.1.1	192.168.2.4	0xc7ac	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
May 6, 2024 20:08:08.372803926 CEST	1.1.1.1	192.168.2.4	0xc7ac	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
May 6, 2024 20:08:08.372803926 CEST	1.1.1.1	192.168.2.4	0xc7ac	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	34.117.186.192	443	7672	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:06 UTC	237	OUT	GET /widget/demo/84.17.40.101 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 18:08:06 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 18:08:06 GMT content-type: application/json; charset=utf-8 Content-Length: 1023 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 18:08:06 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 38 34 2d 31 37 2d 34 30 2d 31 30 31 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4d 69 61 6d 69 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 46 6c 6f 72 69 64 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 32 35 2e 37 37 34 33 2c 2d 38 30 2e 31 39 33 37 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 Data Ascii: { "input": "84.17.40.101", "data": { "ip": "84.17.40.101", "hostname": "unn-84-17-40-101.cdn77.com", "city": "Miami", "region": "Florida", "country": "US", "loc": "25.7743,-80.1937", "org": "AS60068 Datacamp Limited", "
2024-05-06 18:08:06 UTC	282	IN	Data Raw: 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 30 2f 32 34 22 2c 0a 20 20 Data Ascii: }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "84.17.40.0/24",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	104.26.5.15	443	7672	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:08 UTC	261	OUT	GET /demo/home.php?s=84.17.40.101 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 18:08:08 UTC	654	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 18:08:08 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: 6CA2D4AC:5BD0_93878F2E:0050_66391C88_BE6D195:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B4zRw3uPQI8HdIcB1utgepnuJdDyJt96Y%2BUO3cKjO1yHj2aoUK%2FhJOSHqvXj9lLGBOiroayETE9l4m1Lr8BIzDkHxKnTsz72eRjm5yjReUrxEzfZaiJy9zHhiQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87fae9f70a3b4964-MIA alt-svc: h3=":443"; ma=86400
2024-05-06 18:08:08 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 18:08:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	34.117.186.192	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:12 UTC	237	OUT	GET /widget/demo/84.17.40.101 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 18:08:12 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 18:08:12 GMT content-type: application/json; charset=utf-8 Content-Length: 1023 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 18:08:12 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 38 34 2d 31 37 2d 34 30 2d 31 30 31 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4d 69 61 6d 69 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 46 6c 6f 72 69 64 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 32 35 2e 37 37 34 33 2c 2d 38 30 2e 31 39 33 37 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 Data Ascii: { "input": "84.17.40.101", "data": { "ip": "84.17.40.101", "hostname": "unn-84-17-40-101.cdn77.com", "city": "Miami", "region": "Florida", "country": "US", "loc": "25.7743,-80.1937", "org": "AS60068 Datacamp Limited", "
2024-05-06 18:08:12 UTC	282	IN	Data Raw: 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 30 2f 32 34 22 2c 0a 20 20 Data Ascii: }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "84.17.40.0/24",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	34.117.186.192	443	7784	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:12 UTC	237	OUT	GET /widget/demo/84.17.40.101 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 18:08:12 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 18:08:12 GMT content-type: application/json; charset=utf-8 Content-Length: 1023 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 18:08:12 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 38 34 2d 31 37 2d 34 30 2d 31 30 31 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4d 69 61 6d 69 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 46 6c 6f 72 69 64 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 32 35 2e 37 37 34 33 2c 2d 38 30 2e 31 39 33 37 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 Data Ascii: { "input": "84.17.40.101", "data": { "ip": "84.17.40.101", "hostname": "unn-84-17-40-101.cdn77.com", "city": "Miami", "region": "Florida", "country": "US", "loc": "25.7743,-80.1937", "org": "AS60068 Datacamp Limited", "
2024-05-06 18:08:12 UTC	282	IN	Data Raw: 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 30 2f 32 34 22 2c 0a 20 20 Data Ascii: }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "84.17.40.0/24",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	104.26.5.15	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:12 UTC	261	OUT	GET /demo/home.php?s=84.17.40.101 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 18:08:13 UTC	652	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 18:08:12 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4652EB:24F6_93878F2E:0050_66391C8C_BE8B11B:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZIkLvYesWhF7t0CvLLjNvQpxRjbF1%2Bjot1MNRYdkp8uJ2y3NudTPSDA2uXcsyUxTjsh4Excl%2B1F7x0QNuMElgILfeHeYro0QI1CdJBrX1CjqnjeWQQHUuWHBpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87faea105f9f67d4-MIA alt-svc: h3=":443"; ma=86400
2024-05-06 18:08:13 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 18:08:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	104.26.5.15	443	7784	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:12 UTC	261	OUT	GET /demo/home.php?s=84.17.40.101 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 18:08:13 UTC	658	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 18:08:13 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46FEC3:9F52_93878F2E:0050_66391C8D_BE6D21D:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uPXimsJAShAjjRH%2FTpkhdWZOraU0wFOWdRH1QomKafk%2FBkoS4nsbA5sBn6WtfzJp0PzZ38%2BnwLJZ7hp0TK%2BttL8gdgDYdyq1YjOw7I5WRkO92iSExJeif%2BvhBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87faea110b93336e-MIA alt-svc: h3=":443"; ma=86400
2024-05-06 18:08:13 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 18:08:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	34.117.186.192	443	7584	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:16 UTC	237	OUT	GET /widget/demo/84.17.40.101 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 18:08:17 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 18:08:16 GMT content-type: application/json; charset=utf-8 Content-Length: 1023 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 18:08:17 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 38 34 2d 31 37 2d 34 30 2d 31 30 31 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4d 69 61 6d 69 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 46 6c 6f 72 69 64 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 32 35 2e 37 37 34 33 2c 2d 38 30 2e 31 39 33 37 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 Data Ascii: { "input": "84.17.40.101", "data": { "ip": "84.17.40.101", "hostname": "unn-84-17-40-101.cdn77.com", "city": "Miami", "region": "Florida", "country": "US", "loc": "25.7743,-80.1937", "org": "AS60068 Datacamp Limited", "
2024-05-06 18:08:17 UTC	282	IN	Data Raw: 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 30 2f 32 34 22 2c 0a 20 20 Data Ascii: }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "84.17.40.0/24",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	104.26.5.15	443	7584	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:17 UTC	261	OUT	GET /demo/home.php?s=84.17.40.101 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 18:08:17 UTC	658	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 18:08:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4584AE:B2B0_93878F2E:0050_66391C91_BE6D2B7:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SIpQ5dhsnYIdxbgndWvoZtYTUTqAMF4Cxp3%2BgKJEzsjX94%2FctusgN26g2L0N%2Bx%2BfGef9nvMxdl88dzWnbQvWjtNqDTIG9l%2BdeXjV5z4cYIaTUmWOO5s5p3D6pA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87faea2d3b1109d2-MIA alt-svc: h3=":443"; ma=86400
2024-05-06 18:08:17 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 18:08:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	34.117.186.192	443	7592	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:18 UTC	237	OUT	GET /widget/demo/84.17.40.101 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 18:08:18 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 18:08:18 GMT content-type: application/json; charset=utf-8 Content-Length: 1023 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 18:08:18 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 31 30 31 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 38 34 2d 31 37 2d 34 30 2d 31 30 31 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4d 69 61 6d 69 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 46 6c 6f 72 69 64 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 32 35 2e 37 37 34 33 2c 2d 38 30 2e 31 39 33 37 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 Data Ascii: { "input": "84.17.40.101", "data": { "ip": "84.17.40.101", "hostname": "unn-84-17-40-101.cdn77.com", "city": "Miami", "region": "Florida", "country": "US", "loc": "25.7743,-80.1937", "org": "AS60068 Datacamp Limited", "
2024-05-06 18:08:18 UTC	282	IN	Data Raw: 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 34 2e 31 37 2e 34 30 2e 30 2f 32 34 22 2c 0a 20 20 Data Ascii: }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "network": "84.17.40.0/24",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	104.26.5.15	443	7592	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 18:08:18 UTC	261	OUT	GET /demo/home.php?s=84.17.40.101 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 18:08:18 UTC	662	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 18:08:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC463744:4E86_93878F2E:0050_66391C92_BE8B1B3:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sWDWCBD8m6J28L0PdvlkSzbQZGn3y%2B%2B%2FSRcB7q18xMZPGBxaDnqjElimWCvzBbjVNZQrj%2FxcIGnRAxPnLLz6qlk1My%2FBQSOD7LjA%2F6%2BxeB7h8Ajn48y68ZvEUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87faea34dffa9ab3-MIA alt-svc: h3=":443"; ma=86400
2024-05-06 18:08:18 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 18:08:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:07:50
Start date:	06/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf70000
File size:	3'188'736 bytes
MD5 hash:	51014F1C86736D8F91D432548062EBBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2023815185.0000000001CEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1907164226.0000000001CE6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2023815185.0000000001C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:07:52
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xeb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:07:52
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:07:52
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xeb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:07:52
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:07:53
Start date:	06/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x2e0000
File size:	3'188'736 bytes
MD5 hash:	51014F1C86736D8F91D432548062EBBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.2173403489.0000000001838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.2110910326.0000000001838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2173403489.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.2173403489.000000000174D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs Detection: 40%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:07:53
Start date:	06/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x2e0000
File size:	3'188'736 bytes
MD5 hash:	51014F1C86736D8F91D432548062EBBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:08:00
Start date:	06/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x610000
File size:	3'188'736 bytes
MD5 hash:	51014F1C86736D8F91D432548062EBBF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.2022464307.000000000191E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.2022464307.00000000019F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs Detection: 40%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:08:08
Start date:	06/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x610000
File size:	3'188'736 bytes
MD5 hash:	51014F1C86736D8F91D432548062EBBF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2015798047.00000000019D2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2015798047.0000000001A18000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2015798047.0000000001938000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:08:16
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 1944
Imagebase:	0x530000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:08:19
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 1908
Imagebase:	0x530000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:08:20
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 1980
Imagebase:	0x530000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	20:08:43
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 1960
Imagebase:	0x530000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	43

Executed Functions

Function 0104FE80 Relevance: 98.4, APIs: 48, Strings: 6, Instructions: 3939registrytimefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0105008B
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,010D5B0C,00000001,0000002E,0000002F,?,010CB3BC,00F82233,010CB3BC), ref: 0105035B
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 010504D6
FindNextFileA.KERNEL32(00000000,?), ref: 010504EC
FindClose.KERNEL32(00000000), ref: 010504FC
GetLastError.KERNEL32 ref: 01050502
GetLastError.KERNEL32 ref: 01050520

Part of subcall function 01057160: GetCurrentProcess.KERNEL32(01050880), ref: 0105716F
Part of subcall function 01057160: IsWow64Process.KERNEL32(00000000), ref: 01057176

Part of subcall function 00FB196B: GetSystemTimeAsFileTime.KERNEL32(010509F8,00000000,00000000,?,?,?,010509F8,00000000), ref: 00FB1980
Part of subcall function 00FB196B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FB199F

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?,?,?), ref: 01050CB1
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 01050D7D
RegCloseKey.ADVAPI32(?), ref: 01050DB2
GetCurrentHwProfileA.ADVAPI32(?), ref: 01050F4A
GetModuleHandleExA.KERNEL32(00000004,01055F40,?,?,?,?,?,?,?,?,00000000), ref: 0105144B
GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,00000000), ref: 01051463
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 01051E16
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 01051EE2
RegCloseKey.ADVAPI32(?), ref: 01052161
GetComputerNameA.KERNEL32(?,?), ref: 01052195
GetUserNameA.ADVAPI32(?,?), ref: 01052333
GetDesktopWindow.USER32 ref: 010523D6
GetWindowRect.USER32(00000000,?), ref: 010523E4
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 0105254F
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 01052A15
LocalAlloc.KERNEL32(00000040), ref: 01052A27
GetKeyboardLayoutList.USER32(?,00000000), ref: 01052A42
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 01052A6D
LocalFree.KERNEL32(?), ref: 01052C30
GetLocalTime.KERNEL32(?), ref: 01052C47
GetSystemTime.KERNEL32(?), ref: 01052E5D
GetTimeZoneInformation.KERNELBASE(?), ref: 01052E80
TzSpecificLocalTimeToSystemTime.KERNELBASE(?,?,?), ref: 01052EA5
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 010532BF
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 01053411
RegCloseKey.ADVAPI32(?), ref: 010534C2
GetSystemInfo.KERNELBASE(?), ref: 010534EA
GlobalMemoryStatusEx.KERNELBASE(?), ref: 0105359D
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 01053BD3
Process32First.KERNEL32(00000000,?), ref: 01053BEB
Process32Next.KERNEL32(00000000,?), ref: 01053C01
Process32Next.KERNEL32(00000000,?), ref: 01053CD3
CloseHandle.KERNEL32(00000000), ref: 01053CE2
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 01054056
RegEnumKeyExA.KERNELBASE(?,00000000,?,?), ref: 0105408D
wsprintfA.USER32 ref: 01054170
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 01054193
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 01054292
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 01054389
RegCloseKey.ADVAPI32(?), ref: 01054465
RegCloseKey.ADVAPI32(?), ref: 01054480

Strings

*S, xrefs: 01052FE3
!z, xrefs: 01051469
domen, xrefs: 010508A4, 0105092E
*H, xrefs: 01053CE8
2.0, xrefs: 01050947, 010509D8
-Jh, xrefs: 01051CF0

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: CloseTime$FileOpenQueryValue$LocalNameSystem$FindNextProcess32$CreateCurrentErrorFirstHandleInfoKeyboardLastLayoutListLocaleModuleProcessUserWindow$AllocComputerCopyDefaultDesktopDirectoryEnumFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: !z$*H$*S$2.0$domen$-Jh
API String ID: 2403077049-1845743961
Opcode ID: 425a186d8eec3f4d73eba361131d7a07fb56a245a22438c0bb73f54614ec23ed
Instruction ID: e624765737aabe8ebf3a48b539fedea4a91627e556b1c4b4f16def873fb70894
Opcode Fuzzy Hash: 425a186d8eec3f4d73eba361131d7a07fb56a245a22438c0bb73f54614ec23ed
Instruction Fuzzy Hash: AEB3EEB4D0425DCBDB25CF98C981AEEBBB1BF48304F104199E949BB341DB352A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F7B8E0 Relevance: 79.4, APIs: 40, Strings: 2, Instructions: 5855fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7BA08
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7BAD2
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F7BF80
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F7C47A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7C575
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F7C969
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F7CD72
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F7D17B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7D29A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7D6F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F7D9DC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7DAD7
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F7DE41
CopyFileA.KERNEL32(?,?,00000000), ref: 00F7E55A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F7ECF6
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00F7EEEA
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7F45B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7F525
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00F801ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00F80580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00F8088D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F80DC4
CopyFileA.KERNEL32(?,?,00000000), ref: 00F8173C
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F81904
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00F81CD7
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F81E6E
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F81FBE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00F80B14

Part of subcall function 0104FE80: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,010D5B0C,00000001,0000002E,0000002F,?,010CB3BC,00F82233,010CB3BC), ref: 0105035B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F80F12
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7FEF1

Part of subcall function 010566F0: GetLastError.KERNEL32 ref: 01056AA0

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7FC55

Part of subcall function 0104FE80: FindFirstFileA.KERNEL32(00000000,?), ref: 0105008B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7F933

Part of subcall function 010566F0: SetFileAttributesA.KERNEL32(?,00000080,?,?,010F94F8,?), ref: 01056A0A
Part of subcall function 010566F0: DeleteFileA.KERNEL32(?), ref: 01056A24
Part of subcall function 010566F0: RemoveDirectoryA.KERNELBASE(?), ref: 01056A8B
Part of subcall function 010566F0: std::_Throw_Cpp_error.LIBCPMT ref: 01056B67
Part of subcall function 010566F0: std::_Throw_Cpp_error.LIBCPMT ref: 01056B78

Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CCF
Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CE0

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7E6FA

Part of subcall function 01035F80: FindFirstFileA.KERNELBASE(00000000,?,?), ref: 010360BF

Part of subcall function 00F99070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00F9910D
Part of subcall function 00F99070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00F99155

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7DF3C

Part of subcall function 010566F0: FindNextFileA.KERNELBASE(?,00000010), ref: 01056A38
Part of subcall function 010566F0: FindClose.KERNEL32(?), ref: 01056A4A
Part of subcall function 010566F0: GetLastError.KERNEL32 ref: 01056A50
Part of subcall function 010566F0: SetFileAttributesA.KERNELBASE(?,00000080), ref: 01056A6D

CopyFileA.KERNEL32(?,00000000,00000000), ref: 00F7D5FD

Part of subcall function 010566F0: FindFirstFileA.KERNELBASE(00000000,?,010F94F8,?,?,?,\*.*,00000004,?), ref: 01056865

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00F7BB07

Part of subcall function 01056C20: GetFileAttributesA.KERNELBASE(?), ref: 01056C7C
Part of subcall function 01056C20: GetLastError.KERNEL32 ref: 01056C87

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7BD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00F7BD37
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7C0CC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7C196

Strings

U[b, xrefs: 00F7DB68
1!u, xrefs: 00F7C9EC

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Directory$Create$File$Copy$Find$Cpp_errorThrow_std::_$AttributesErrorFirstLast$FolderPath___std_fs_convert_narrow_to_wide@20$CloseDeleteNextRemove
String ID: 1!u$U[b
API String ID: 1172780710-4099298338
Opcode ID: f046e4aacda890f59fe4215b51f25e16a54af68afdf5f209af5d771cd5bbecf2
Instruction ID: 78ade5e7afa06ec8ecdb7e8edf88cff28945bc73ebf636d6b8a2e49154c40f62
Opcode Fuzzy Hash: f046e4aacda890f59fe4215b51f25e16a54af68afdf5f209af5d771cd5bbecf2
Instruction Fuzzy Hash: D9F3E0B4D0425D8BDF25CFA8D981AEEBBB0BF48304F50419AD849B7341DB352A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0101A180 Relevance: 63.8, APIs: 10, Strings: 15, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 0101A1F7

Part of subcall function 01035F80: FindFirstFileA.KERNELBASE(00000000,?,?), ref: 010360BF

Strings

\, xrefs: 0102CA4E
@+'f, xrefs: 01026135
[2?, xrefs: 010347C0
[2?, xrefs: 0102CCD6
@+'f, xrefs: 0102639D
[2?, xrefs: 0102AF32
@+'f, xrefs: 0103486C
[2?, xrefs: 010262EB
[2?, xrefs: 010226F8
cannot use push_back() with , xrefs: 0102103B, 010212B3, 010232E7, 010234D8, 01028216, 010283AE, 0102DF49, 0102DFA0, 0102DFF4, 0102FDA3, 0102FF7B, 01031C59, 01031E00, 01035EDA
cannot use operator[] with a string argument with , xrefs: 01021475, 010214AD, 01021500, 01021535, 0102156C, 01023442, 01023480, 01023535, 01028374, 0102840D, 0102DEED, 0102E054, 0102E0A9, 0102E0FE, 0102E159, 0102E1AE, 0102E203, 0102E258, 0102E2AD, 0102E302, 0102FEE5, 0102FF23, 0102FFD8, 01031D6A, 01031DA8, 01031E5D, 01035E68, 01035EA0, 01035F32
1/h, xrefs: 0102C9C0
@+'f, xrefs: 010227A4
U#:, xrefs: 0102AC10
@+'f, xrefs: 0102AFCC

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: 1/h$@+'f$@+'f$@+'f$@+'f$@+'f$U#:$[2?$[2?$[2?$[2?$[2?$\$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-2428695108
Opcode ID: f1ad5fd06d734092c259796010c09d8634ab35d7e7b56e3b05fdebdac33cf53c
Instruction ID: 094164f0b7878548d51a3c056d143ffccc94316cc9280bbe8cd58f225a29ed90
Opcode Fuzzy Hash: f1ad5fd06d734092c259796010c09d8634ab35d7e7b56e3b05fdebdac33cf53c
Instruction Fuzzy Hash: CEB421B0D052698BDB65CF68CD84BEEBBB1BF49304F1081DAD849A7241DB356B84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01047580 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,010CB0B2,000000FF), ref: 010475EC
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 01047613
CreateDirectoryA.KERNEL32(?,00000000), ref: 010478D9
CreateDirectoryA.KERNEL32(?,00000000), ref: 01047C3B
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 01048D77
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 01049912
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104A29E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0104A36F
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104A692
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104A9FD
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0104AACE
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104ADB9
CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 0104B049
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104B1FC
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104B4D6
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104B8BC
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 0104BC71
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104BE24
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104C0FE
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104C4E4
CreateDirectoryA.KERNEL32(?,00000000), ref: 01049F33

Part of subcall function 0104FE80: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 010504D6
Part of subcall function 0104FE80: GetLastError.KERNEL32 ref: 01050520

CreateDirectoryA.KERNEL32(?,00000000), ref: 0104C91C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0104CA73

Part of subcall function 0104E3B0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0104E41D

CreateDirectoryA.KERNEL32(?,00000000), ref: 01049BD3

Part of subcall function 010566F0: SetFileAttributesA.KERNEL32(?,00000080,?,?,010F94F8,?), ref: 01056A0A
Part of subcall function 010566F0: DeleteFileA.KERNEL32(?), ref: 01056A24
Part of subcall function 010566F0: RemoveDirectoryA.KERNELBASE(?), ref: 01056A8B
Part of subcall function 010566F0: std::_Throw_Cpp_error.LIBCPMT ref: 01056B67
Part of subcall function 010566F0: std::_Throw_Cpp_error.LIBCPMT ref: 01056B78

Part of subcall function 010566F0: GetLastError.KERNEL32 ref: 01056AA0

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 010495C8

Part of subcall function 0104FE80: FindNextFileA.KERNEL32(00000000,?), ref: 010504EC
Part of subcall function 0104FE80: FindClose.KERNEL32(00000000), ref: 010504FC
Part of subcall function 0104FE80: GetLastError.KERNEL32 ref: 01050502

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0104915D

Part of subcall function 010566F0: FindNextFileA.KERNELBASE(?,00000010), ref: 01056A38
Part of subcall function 010566F0: FindClose.KERNEL32(?), ref: 01056A4A
Part of subcall function 010566F0: GetLastError.KERNEL32 ref: 01056A50
Part of subcall function 010566F0: SetFileAttributesA.KERNELBASE(?,00000080), ref: 01056A6D

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 010488EA

Part of subcall function 0104FE80: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,010D5B0C,00000001,0000002E,0000002F,?,010CB3BC,00F82233,010CB3BC), ref: 0105035B

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 01048A9D
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 010482E2

Part of subcall function 010566F0: FindFirstFileA.KERNELBASE(00000000,?,010F94F8,?,?,?,\*.*,00000004,?), ref: 01056865

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 010485A3
CreateDirectoryA.KERNEL32(?,00000000), ref: 01047F9B

Part of subcall function 0104FE80: FindFirstFileA.KERNEL32(00000000,?), ref: 0105008B

Part of subcall function 01056C20: GetFileAttributesA.KERNELBASE(?), ref: 01056C7C
Part of subcall function 01056C20: GetLastError.KERNEL32 ref: 01056C87

Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CCF
Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CE0

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID:
API String ID: 1140557632-0
Opcode ID: 996244d545cc3df7dbd54689d964c808f905116c3bcff54c14c4f3b803577219
Instruction ID: 2c103e907dcdc1833ad78b3e995788df22789750d9bf0ac8e69945150091299c
Opcode Fuzzy Hash: 996244d545cc3df7dbd54689d964c808f905116c3bcff54c14c4f3b803577219
Instruction Fuzzy Hash: 6AF312B4D0425A8BDF15CFA8C9916EEBBB0BF48304F144199D949BB341DB356B84CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 010003C0 Relevance: 28.0, APIs: 13, Strings: 2, Instructions: 1749registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?), ref: 010007BB
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 010007EF
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 01000815
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 010009AC
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 01000C33
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 01000D20
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 01000E61
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 01000F4B
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 01001035
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0100111F
RegCloseKey.ADVAPI32(?), ref: 0100221B
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 01002251
RegCloseKey.ADVAPI32(?), ref: 01002265

Strings

cannot use push_back() with , xrefs: 010022C5
cannot use operator[] with a string argument with , xrefs: 0100231E, 01002373

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2041898428-3306948993
Opcode ID: e2c67591ab847671a05cd1b61d9531e7587cfb78c4ca6a9a8f152cae576d8dec
Instruction ID: 2270a3b509e037e61277e589d7344a456ce6facc38b9bd2a58009110a1a9387c
Opcode Fuzzy Hash: e2c67591ab847671a05cd1b61d9531e7587cfb78c4ca6a9a8f152cae576d8dec
Instruction Fuzzy Hash: 2E1335B4C042688BDB26CF28CC84BEEBBB5BF49304F1481DAE549A7241DB756B84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0100F050 Relevance: 22.4, APIs: 6, Strings: 5, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0100F1A4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0100F2A2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0100F495
CreateDirectoryA.KERNEL32(?,00000000), ref: 01011BF6

Part of subcall function 01056C20: GetFileAttributesA.KERNELBASE(?), ref: 01056C7C
Part of subcall function 01056C20: GetLastError.KERNEL32 ref: 01056C87

CreateDirectoryA.KERNEL32(?,00000000), ref: 01011EDD
lstrlen.KERNEL32(?), ref: 0101340E

Strings

cannot use push_back() with , xrefs: 01013498
cannot use operator[] with a string argument with , xrefs: 010134F1, 01013546
[2?, xrefs: 0100FAA8
[2?, xrefs: 0100FC66
Bbb, xrefs: 0100F996

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: Bbb$[2?$[2?$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2833034228-788601495
Opcode ID: 3a2e18872f33ad783421828263d7d28b9018186f390cfbddf47cb5fad6f49123
Instruction ID: fb2724bb5978cad53755e03f8012756d8628ec04b3fdb5606c490a8d7c6eb48c
Opcode Fuzzy Hash: 3a2e18872f33ad783421828263d7d28b9018186f390cfbddf47cb5fad6f49123
Instruction Fuzzy Hash: CA93CCB4D052A88ADB65DF28CD91BEDBBB5BF49304F0081DAD84DA7241DB752B84CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00FF1B90 Relevance: 21.5, APIs: 7, Strings: 4, Instructions: 2202COMMON

Download Yara Rule

APIs

Part of subcall function 01056C20: GetFileAttributesA.KERNELBASE(?), ref: 01056C7C
Part of subcall function 01056C20: GetLastError.KERNEL32 ref: 01056C87

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 00FF272B
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00FF2A27
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00FF2D25
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00FF3085
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00FF33B3
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 00FF36B7
Concurrency::cancel_current_task.LIBCPMT ref: 00FF4461

Strings

type must be string, but is , xrefs: 00FF44DB
cannot get value, xrefs: 00FF43DE, 00FF4518
type must be boolean, but is , xrefs: 00FF4487
cannot compare iterators of different containers, xrefs: 00FF441D

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: FolderPath$AttributesConcurrency::cancel_current_taskErrorFileLast
String ID: cannot compare iterators of different containers$cannot get value$type must be boolean, but is $type must be string, but is
API String ID: 1974481932-2698695959
Opcode ID: 222baadde9483de368723ab2a877b1e5368b34aaca56ed25d598c01d5a98fea8
Instruction ID: cb53958bd0f8afe95d1fadc3dad99e5e3b280fabbed801b795608b13c9410a12
Opcode Fuzzy Hash: 222baadde9483de368723ab2a877b1e5368b34aaca56ed25d598c01d5a98fea8
Instruction Fuzzy Hash: 214312B0D052688BDB25CF24CD94BEEBBB5BF48304F1082D9D949A7241EB356B84DF91

Uniqueness

Uniqueness Score: -1.00%

Function 010566F0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,010F94F8,?,?,?,\*.*,00000004,?), ref: 01056865
SetFileAttributesA.KERNEL32(?,00000080,?,?,010F94F8,?), ref: 01056A0A
DeleteFileA.KERNEL32(?), ref: 01056A24
FindNextFileA.KERNELBASE(?,00000010), ref: 01056A38
FindClose.KERNEL32(?), ref: 01056A4A
GetLastError.KERNEL32 ref: 01056A50
SetFileAttributesA.KERNELBASE(?,00000080), ref: 01056A6D
RemoveDirectoryA.KERNELBASE(?), ref: 01056A8B
GetLastError.KERNEL32 ref: 01056AA0
std::_Throw_Cpp_error.LIBCPMT ref: 01056B67
std::_Throw_Cpp_error.LIBCPMT ref: 01056B78

Strings

\*.*, xrefs: 010567B4

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: 5de1f7c1bb54bd3a6920e7aca562e04267b6e5a1feb78b9afce08eba525fa42d
Instruction ID: 553acd31015f6d77a0d373831596f81eeb02ba6f02587e0669a2370bbf5576bb
Opcode Fuzzy Hash: 5de1f7c1bb54bd3a6920e7aca562e04267b6e5a1feb78b9afce08eba525fa42d
Instruction Fuzzy Hash: 02D1F270D002488FEB64CFA8C8497EEBBF1FF45314F248259E895AB282D7765A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01006330 Relevance: 19.3, APIs: 5, Strings: 5, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 01006484
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 01006582
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 01006775
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01007FF8
lstrlen.KERNEL32(?), ref: 010084CF

Strings

cannot use push_back() with , xrefs: 0100838C, 0100858E
cannot use operator[] with a string argument with , xrefs: 0100853E, 010085F0
`gn+, xrefs: 01007290
[2?, xrefs: 01007502
@+'f, xrefs: 0100759C

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: @+'f$[2?$`gn+$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-818090161
Opcode ID: 36e3d1e0d01db72e45402976f50674991e75eb6ef2d723b734285871a7f10ff3
Instruction ID: abfc0f3b6d2c117c0f52af5e27fe52b5152bc2b02c1a49ec955aaf8d77d2b6bc
Opcode Fuzzy Hash: 36e3d1e0d01db72e45402976f50674991e75eb6ef2d723b734285871a7f10ff3
Instruction Fuzzy Hash: AF23F0B4D052688BDB65CF28CC84BEEBBB5BF49304F1081D9E949A7241DB356B84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01008630 Relevance: 17.9, APIs: 4, Strings: 5, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 01008784
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 01008882
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 01008A78
lstrlen.KERNEL32(?), ref: 0100AD91

Strings

cannot use push_back() with , xrefs: 0100ACB1, 0100AE3A
cannot use operator[] with a string argument with , xrefs: 0100AE03, 0100AE99
J6, xrefs: 0100940E
(2?, xrefs: 010094EA
[2?, xrefs: 010096A8

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: (2?$[2?$cannot use operator[] with a string argument with $cannot use push_back() with $J6
API String ID: 1311570089-2412125412
Opcode ID: 7b0273164117e02fd55129ecf21df0ab8826cee7d9f9f2fb583372a7f5e9af44
Instruction ID: 8117aa99dfa6bfd030f333eeea053058b1c304e938f9cb6f38d3e37406ae18c5
Opcode Fuzzy Hash: 7b0273164117e02fd55129ecf21df0ab8826cee7d9f9f2fb583372a7f5e9af44
Instruction Fuzzy Hash: 114322B0D052688BDB65CF28CC847EEBBB5BF49304F1481D9E489A7242DB756B84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0100D320 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0100D474
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0100D572
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0100D765
lstrlen.KERNEL32(?), ref: 0100EEB2

Strings

cannot use push_back() with , xrefs: 0100EDF6, 0100EFAB
cannot use operator[] with a string argument with , xrefs: 0100EF1D, 0100EF5B, 0100F00D

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: e6b40fff52a961fcb62c23553e23f551025cd80455291800604d2475b4f59c29
Instruction ID: 6536aaba12ffe08dd6c9b4f1941ae14ef51e126520a583274146dda81d9edb9c
Opcode Fuzzy Hash: e6b40fff52a961fcb62c23553e23f551025cd80455291800604d2475b4f59c29
Instruction Fuzzy Hash: 460336B0D042688BDB25DF28CD84BEEBBB5BF49304F1481D9E449A7281DB756B84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01036D00 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 535
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 01036FD1

Part of subcall function 00FA2534: __EH_prolog3.LIBCMT ref: 00FA2570

std::_Throw_Cpp_error.LIBCPMT ref: 01036FE2

Part of subcall function 01057440: __fread_nolock.LIBCMT ref: 01057589

DeleteFileA.KERNELBASE(?), ref: 0103706B

Strings

domen, xrefs: 010370F1, 0103710A
131, xrefs: 010370B5, 010370CE

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$domen
API String ID: 3880692912-3142631537
Opcode ID: 6ab3825beccd1c5001dfc3d9cef7574ad20cd04b9a59c3eed429ac924256ee1a
Instruction ID: 026151de457468b6383c2766dbb579c3eeeed0f4f949f33b9fffacf56199293b
Opcode Fuzzy Hash: 6ab3825beccd1c5001dfc3d9cef7574ad20cd04b9a59c3eed429ac924256ee1a
Instruction Fuzzy Hash: 0E32AEB1D00248DFDB14DF98C8417AEBBB1FF89304F148199E9856B382D779AA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0106AC30 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BINARY, xrefs: 0106AE55, 0106AE64, 0106AE7E, 0106AEBE, 0106AEC9, 0106AEE1, 0106AF33, 0106AF34
automatic extension loading failed: %s, xrefs: 0106B15C
MATCH, xrefs: 0106B038, 0106B049, 0106B069, 0106B06A, 0106B080
no such vfs: %s, xrefs: 0106ADE7
sqlite_rename_table, xrefs: 0106B014
RTRIM, xrefs: 0106AE98
NOCASE, xrefs: 0106AF5A

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: 480bb5278d5aabf5c5974fe9a8fbd2c4a765f5f473b0f49104770d57f95fc2af
Instruction ID: 52914f8a09e47d9b3767a39c8a35f553da90c17a4340d4df802a06eb1f223302
Opcode Fuzzy Hash: 480bb5278d5aabf5c5974fe9a8fbd2c4a765f5f473b0f49104770d57f95fc2af
Instruction Fuzzy Hash: 4F0216B0B00705DFEB719F29C8857ABBBE8AF50304F04446CE9DADB681D7B6A544CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0104EFB0 Relevance: 8.4, APIs: 5, Instructions: 876
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0104F01A
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104F2A9

Part of subcall function 01056C20: GetFileAttributesA.KERNELBASE(?), ref: 01056C7C
Part of subcall function 01056C20: GetLastError.KERNEL32 ref: 01056C87

CreateDirectoryA.KERNEL32(?,00000000), ref: 0104F4AA
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104F7CA

Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CCF
Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CE0

CreateDirectoryA.KERNEL32(?,00000000), ref: 0104FBFD

Part of subcall function 010566F0: FindFirstFileA.KERNELBASE(00000000,?,010F94F8,?,?,?,\*.*,00000004,?), ref: 01056865

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID:
API String ID: 2127212259-0
Opcode ID: 3ac85ec7ba3ffb8cf61b720a37e00ee28bb01c43cf28c0709d708fa8e947775c
Instruction ID: 061f435933fa919ec9a67214429564fd1c2bf623d4561012e9eff548e1e504db
Opcode Fuzzy Hash: 3ac85ec7ba3ffb8cf61b720a37e00ee28bb01c43cf28c0709d708fa8e947775c
Instruction Fuzzy Hash: 89A2E0B4D0425ECBDB25CFA8C991AEEBBB0BF48314F244199D949BB241D7311B84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0104E3B0 Relevance: 8.2, APIs: 5, Instructions: 731
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0104E41D

Part of subcall function 01056C20: GetFileAttributesA.KERNELBASE(?), ref: 01056C7C
Part of subcall function 01056C20: GetLastError.KERNEL32 ref: 01056C87

Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CCF
Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CE0

CreateDirectoryA.KERNEL32(?,00000000), ref: 0104E849
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0104EA03
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104EC91
CreateDirectoryA.KERNEL32(?,00000000), ref: 0104EDE7

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID:
API String ID: 1001086254-0
Opcode ID: 2c9dc16ac21869e78a7662c57e0e4bf3c22425d3168c6508b0ef8559ea779b7d
Instruction ID: 36688e9055413b833ee3538d0c7bfc563ca61645fc5db25a4955994853ea0a73
Opcode Fuzzy Hash: 2c9dc16ac21869e78a7662c57e0e4bf3c22425d3168c6508b0ef8559ea779b7d
Instruction Fuzzy Hash: B68205B4C00259DBDB25CFA8C9957EEBBB0BF48304F148199D949BB241E7345B84DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01035F80 Relevance: 6.3, APIs: 4, Instructions: 310fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(00000000,?,?), ref: 010360BF
FindNextFileA.KERNELBASE(00000000,00000010), ref: 010363BF
GetLastError.KERNEL32 ref: 010363CD
FindClose.KERNEL32(00000000), ref: 010363DD

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: 99718d5fbee46d41bbb18a337fb21859037fb028cac30bc24e9078da89a15820
Instruction ID: c027e563161558de4c864ec6e565256df80883655198bfb615cd7b2ac17d94ed
Opcode Fuzzy Hash: 99718d5fbee46d41bbb18a337fb21859037fb028cac30bc24e9078da89a15820
Instruction Fuzzy Hash: 2ED16AB0C002489FDB21CF98C9857EEFBB5FF45314F148299E489AB242D7755A84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01036A80 Relevance: 4.7, APIs: 3, Instructions: 206encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 01036AD7
LocalFree.KERNEL32(?), ref: 01036B06
LocalFree.KERNEL32(?), ref: 01036C02

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: 61f149f1d17715d17a9af66886c2e29da113bc7a046b406d6d5d2f6461e64977
Instruction ID: 2d514d5c2e2d48194d81825457c71430e42fe46c4405432a0dab9670195f3eb4
Opcode Fuzzy Hash: 61f149f1d17715d17a9af66886c2e29da113bc7a046b406d6d5d2f6461e64977
Instruction Fuzzy Hash: 1171A271C00248ABDF10DFA8C8457EEFBB4FB45710F14826AE854A7381EB795A45DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FA1F9C Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,00F8D027,?,?,?,00F94721), ref: 00FA1FA8
FindFirstFileExW.KERNELBASE(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,00F8D027,?,?,?,00F94721), ref: 00FA1FD7
GetLastError.KERNEL32(?,00F8D027,?,?,?,00F94721), ref: 00FA1FE9

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: f246f0612b4504761e54990aa2a157a4755791570a1e17db1361a7b9ae63a3a0
Instruction ID: be5eff1fe8d57c1679c6186e381749df88dcbf038f25f1915240c4957338861b
Opcode Fuzzy Hash: f246f0612b4504761e54990aa2a157a4755791570a1e17db1361a7b9ae63a3a0
Instruction Fuzzy Hash: 36F08971004248BFDB206FA4DC04DBABB5DFB15370F104625FD69C55A1D73299A1ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 010AF480 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 010AF635
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 010AF937

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 519abb52efa4086553ab16c753e20ae7d34ca21ac1cc3af2d0f3dc60adbcef42
Instruction ID: 16a8c6db243ae65e0f81b501045b403742bd4df629e80d094e6303fe93896da5
Opcode Fuzzy Hash: 519abb52efa4086553ab16c753e20ae7d34ca21ac1cc3af2d0f3dc60adbcef42
Instruction Fuzzy Hash: 0F02AF70A04603AFDB55CFA8C840BAEB7E0BF88314F8486ADE5C9CB651D774E955CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FB002D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24992355a0eda5502c8035fa6e1eb61bf33470bcf876f02603ed5b7d9346679b
Instruction ID: 13ea601005d3e35f00f3c8175cea45906ff0fdf7ad6c01f2fa045629e582b161
Opcode Fuzzy Hash: 24992355a0eda5502c8035fa6e1eb61bf33470bcf876f02603ed5b7d9346679b
Instruction Fuzzy Hash: 52B1F371D0060B9BCB28DF6AC859BFFB7B1AF00320F184619D45297691CF34AA45EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00FC8BB0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597b09acd9d4de22415db2b753f647b468eadb78f94d08e798e74b5819e04bcb
Instruction ID: 790e2dcaa8f901469eb7c2ae92ef7384789d8c53f54fa7946ec4bf1c54946570
Opcode Fuzzy Hash: 597b09acd9d4de22415db2b753f647b468eadb78f94d08e798e74b5819e04bcb
Instruction Fuzzy Hash: A38112B5D002568FDB10CF58D9C2BBEBBB4EB1A354F04016DD85597783C739990AEBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F880A0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a1891bab6c37d480982029cda2f26540c06dce03b6b59528c408e879104ba5
Instruction ID: f8d9f6dee9feeae08cb5a238361c83c34c1700182c2ccf960a4e7aa8238ca941
Opcode Fuzzy Hash: 94a1891bab6c37d480982029cda2f26540c06dce03b6b59528c408e879104ba5
Instruction Fuzzy Hash: 0C318BB1900209DFDB10EF84C885BAEBBF4FF08314F108599E514AB392D775AA05DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01037A80 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000003E0,0000FFFF,00001006,?,00000008), ref: 01037B26
recv.WS2_32(?,00000004,00000002), ref: 01037B41
WSAGetLastError.WS2_32 ref: 01037B45
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 01037BC3
recv.WS2_32(00000000,0000000C,00000008), ref: 01037BE4
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 01037C80
recv.WS2_32(00000000,?,00000008), ref: 01037C9B

Part of subcall function 01038510: WSAStartup.WS2_32 ref: 0103853A
Part of subcall function 01038510: getaddrinfo.WS2_32(?,?,?,010F9328), ref: 010385BC
Part of subcall function 01038510: socket.WS2_32(?,?,?), ref: 010385DD
Part of subcall function 01038510: connect.WS2_32(00000000,010C9B1C,?), ref: 010385F1
Part of subcall function 01038510: closesocket.WS2_32(00000000), ref: 010385FD
Part of subcall function 01038510: FreeAddrInfoW.WS2_32(?), ref: 0103860A
Part of subcall function 01038510: WSACleanup.WS2_32 ref: 01038610

recv.WS2_32(?,00000004,00000008), ref: 01037DA3
__Xtime_get_ticks.LIBCPMT ref: 01037DAA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01037DB8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 01037E31
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 01037E39

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: e2f6517e6baf714be996dc45916bd194074bc35a136aac340fe1a08d32602b84
Instruction ID: f93a430dd13b965758bfab285af2d4471700f6efbbc7edb6a5eb52eb889f7cfa
Opcode Fuzzy Hash: e2f6517e6baf714be996dc45916bd194074bc35a136aac340fe1a08d32602b84
Instruction Fuzzy Hash: FAB1BCB1D00308DFEB21DFA8CC4ABADBBB5BB88304F104259E594AB6C2D7795944DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00FCE0C0 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F7B8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 00F7BA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00FCE1C2
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 00FCE353
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 00FCE446
CreateDirectoryA.KERNEL32(?,00000000), ref: 00FCE53C
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00FCE788
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00FCE906
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 00FCEA9D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 00FCEB90

Part of subcall function 01056C20: GetFileAttributesA.KERNELBASE(?), ref: 01056C7C
Part of subcall function 01056C20: GetLastError.KERNEL32 ref: 01056C87

CreateDirectoryA.KERNEL32(?,00000000), ref: 00FCEC86

Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CCF
Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CE0

CreateDirectoryA.KERNEL32(?,00000000), ref: 00FCED6D
CreateDirectoryA.KERNEL32(?,00000000), ref: 00FCEFED

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 856f9fbf0170c2a1c7047535d55c55c14cdda28e0797525699dda75f07869262
Instruction ID: 5269f84a68727c49164860114d9ac1c0f00e8458cb4968a35fab8875c9ca5ab2
Opcode Fuzzy Hash: 856f9fbf0170c2a1c7047535d55c55c14cdda28e0797525699dda75f07869262
Instruction Fuzzy Hash: 86A214B0D00269CBDB25EB64CD95BDDBBB4AF14304F4081EAD44AA7242EB355F88DF52

Uniqueness

Uniqueness Score: -1.00%

Function 010546A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 010549F0
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 01054A5C
LsaOpenPolicy.ADVAPI32(00000000,010F7684,00000001,?), ref: 01054AB5
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 01054AC8
LsaFreeMemory.ADVAPI32(?), ref: 01054AF6
LsaClose.ADVAPI32(?), ref: 01054AFF

Strings

%wZ, xrefs: 01054AE5

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ
API String ID: 762890658-705104578
Opcode ID: 61b2b9ade080017d63efc1074378855da924af2e03dcadec0b6e669bd44ab0bc
Instruction ID: 1d92db37ff78e12ecaa3940d15125699d3416b167ab0a3cdf22a3a5537df947d
Opcode Fuzzy Hash: 61b2b9ade080017d63efc1074378855da924af2e03dcadec0b6e669bd44ab0bc
Instruction Fuzzy Hash: 44E1E3B4D0425A9BDB24CF98C986BEEBBB4FF08304F204199E949B7341D7745A84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01038510 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0103853A
getaddrinfo.WS2_32(?,?,?,010F9328), ref: 010385BC
socket.WS2_32(?,?,?), ref: 010385DD
connect.WS2_32(00000000,010C9B1C,?), ref: 010385F1
closesocket.WS2_32(00000000), ref: 010385FD
FreeAddrInfoW.WS2_32(?), ref: 0103860A
WSACleanup.WS2_32 ref: 01038610
FreeAddrInfoW.WS2_32(?), ref: 01038625

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: f19b1e35c8325e2c71dc9f4997b0ebb54d2b728e27fe63b5cf4cd0818ae3d4ca
Instruction ID: 27a9a5af8d65d154700ff3df3bd45b44539886a6e57baf61b3c5d739b7fe864d
Opcode Fuzzy Hash: f19b1e35c8325e2c71dc9f4997b0ebb54d2b728e27fe63b5cf4cd0818ae3d4ca
Instruction Fuzzy Hash: 1F31C072504700AFD7219F68DC4862BBBE9BBC8724F108BAEF9E4931D1D33198049B92

Uniqueness

Uniqueness Score: -1.00%

Function 00FB8910 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1051090f12a877faf66e5d4032f47e504b60af8ce2e07f1fd3631e1f3404b19
Instruction ID: e375c4f14d1b4e694aeb6e7a83e258287855ec1b83d59d9f42c2cbf4413ceaed
Opcode Fuzzy Hash: c1051090f12a877faf66e5d4032f47e504b60af8ce2e07f1fd3631e1f3404b19
Instruction Fuzzy Hash: 5EB106B1E00249AFDB11DFAAC891BFE7BB9BFC5390F144159E44497282CB749942EF60

Uniqueness

Uniqueness Score: -1.00%

Function 01046B20 Relevance: 9.2, APIs: 6, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 01046B53
6D0E7CF0.RSTRTMGR(?,00000000,?), ref: 01046BD0
SetLastError.KERNEL32(00000000), ref: 01046C7E
CopyFileA.KERNEL32(?,?,00000000), ref: 01046CA5
GetLastError.KERNEL32(?,?,00000000), ref: 01046CB3
CopyFileA.KERNEL32(?,?,00000000), ref: 01046CC7

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: ErrorLast$CopyFile
String ID:
API String ID: 936320341-0
Opcode ID: d9484d4bb4211c67327bf776f49882b71d402dd62540ababe1da7b7dc66a56f8
Instruction ID: 6b7cce07ceea7fe947f5294971bd6e4992e49e336ec1c9ea469ce68238523d16
Opcode Fuzzy Hash: d9484d4bb4211c67327bf776f49882b71d402dd62540ababe1da7b7dc66a56f8
Instruction Fuzzy Hash: 1451A072D0121DAFDB21DFD4DC40BEEBBB9EB05320F10426AE955B7281D77A5A058B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F79280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,010BD08C,00000000,74D723A0,-010F9880), ref: 00F796A6
GetProcAddress.KERNEL32(00000000,?), ref: 00F796B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,010BD08C,00000000,74D723A0,-010F9880), ref: 00F796C9

Strings

Ws2_32.dll, xrefs: 00F7969A

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 4babd06f4b314384936d7e5a142176737c4ad9c8fcbfe04069f07364a5798cfb
Instruction ID: 7730cbcc80c2be6be225b15651ab3484ce321672052d1fe3f5540f1ee9bbfb8a
Opcode Fuzzy Hash: 4babd06f4b314384936d7e5a142176737c4ad9c8fcbfe04069f07364a5798cfb
Instruction Fuzzy Hash: 2802D170D04298DFDF25CF94C8907ADBBB0EF55314F24828EE4896B682D7B41986DB92

Uniqueness

Uniqueness Score: -1.00%

Function 01003AE0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 264
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 01003D09
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?), ref: 01003D2C
RegCloseKey.ADVAPI32(?), ref: 01003D37

Strings

21o, xrefs: 01003BB4

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: 21o
API String ID: 3677997916-1934072765
Opcode ID: 96598be86be4051ccb2a121559a7593c25d521f916f7cafcae92dab75570e769
Instruction ID: 934390eb84a95fd9c759187ab60bed597c6de46237446aceb31ef6004da10488
Opcode Fuzzy Hash: 96598be86be4051ccb2a121559a7593c25d521f916f7cafcae92dab75570e769
Instruction Fuzzy Hash: DEC126B1D042499FDB15CFA8C986BEEBBB0FF08310F244259E945BB381D7355A849FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD37B0 Relevance: 6.9, APIs: 3, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 01056C20: GetFileAttributesA.KERNELBASE(?), ref: 01056C7C
Part of subcall function 01056C20: GetLastError.KERNEL32 ref: 01056C87

Part of subcall function 01056B90: CreateDirectoryA.KERNELBASE(?,00000000,00000005,?), ref: 01056BD5

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00FD5C30
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00FD5F55

Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CCF
Part of subcall function 01056C20: std::_Throw_Cpp_error.LIBCPMT ref: 01056CE0

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00FD5E46

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 5a56222b767c231434c40fa042ee0f87c2a48d9368c4757b389ac1e3f9bb22ba
Instruction ID: c10b2f80980d129c63a0df77d768c102adc7cb28de8a402ccd6a3ad0f4e8114c
Opcode Fuzzy Hash: 5a56222b767c231434c40fa042ee0f87c2a48d9368c4757b389ac1e3f9bb22ba
Instruction Fuzzy Hash: D353BCB1D052688BDB65EF14CD94BEDBBB5AF48300F0481EAE44AA7251DB342F84DF91

Uniqueness

Uniqueness Score: -1.00%

Function 01056C20 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?), ref: 01056C7C
GetLastError.KERNEL32 ref: 01056C87
std::_Throw_Cpp_error.LIBCPMT ref: 01056CCF
std::_Throw_Cpp_error.LIBCPMT ref: 01056CE0

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: c5c7cb887589d534fae5ec7c84db6a82fe7055ee8a64ad32b4eecc20f6e17bfa
Instruction ID: b0979e0418f53bd0243229cbe7b6279a1fafdb0f0352919dbce1ba5e0f940a97
Opcode Fuzzy Hash: c5c7cb887589d534fae5ec7c84db6a82fe7055ee8a64ad32b4eecc20f6e17bfa
Instruction Fuzzy Hash: 8E117BB0D0010C9BDFA44FAC984677A3F94E742724FA40398E9E59BAC1CA2344009751

Uniqueness

Uniqueness Score: -1.00%

Function 01046710 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 010469A0

Part of subcall function 01046B20: GetLastError.KERNEL32(?,00000000), ref: 01046B53
Part of subcall function 01046B20: 6D0E7CF0.RSTRTMGR(?,00000000,?), ref: 01046BD0

std::_Throw_Cpp_error.LIBCPMT ref: 01046B04
std::_Throw_Cpp_error.LIBCPMT ref: 01046B15

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyErrorFileLast
String ID:
API String ID: 1723067277-0
Opcode ID: 1b798be2d64a0327a0515910eb8da5f9f97b795171758bcde685431adc8a94fa
Instruction ID: b43bcccf56e95be724d1cfd9f1b827eb33d567f563af48025473cba96e693863
Opcode Fuzzy Hash: 1b798be2d64a0327a0515910eb8da5f9f97b795171758bcde685431adc8a94fa
Instruction Fuzzy Hash: 6DD18AB0D00249CBDB14DFA8C9457EEBBB0FF45304F148199D849B7282EB755A89CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01056B90 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005,?), ref: 01056BD5

Part of subcall function 00FA2BAA: RtlReleaseSRWLockExclusive.NTDLL(-00000008), ref: 00FA2BBE

std::_Throw_Cpp_error.LIBCPMT ref: 01056C04
std::_Throw_Cpp_error.LIBCPMT ref: 01056C15

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 642ae25fd536ac617308821f261afb2269136de9e56c8f04b2d1bf3cc0b6a32e
Instruction ID: 5f9fe096bb261143f9dec542e79f50363645e43bc78ffd537ccadec22b9bf382
Opcode Fuzzy Hash: 642ae25fd536ac617308821f261afb2269136de9e56c8f04b2d1bf3cc0b6a32e
Instruction Fuzzy Hash: 0CF026B0A00204EFC3649F5D9C07B5A77A8E742B34F10036DF9355B7C0EB7A180087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FBB9D0 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,00FAD2B1,?), ref: 00FBB9D8
GetLastError.KERNEL32(?,00FAD2B1,?), ref: 00FBB9E2
__dosmaperr.LIBCMT ref: 00FBB9E9

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 141c640926f50b5c23b820647a376d37c6da2924abcca26be348851199480aa2
Instruction ID: 447825e73cdbe6ab31101190c0d83c796bad4f36c3155297619f578880714129
Opcode Fuzzy Hash: 141c640926f50b5c23b820647a376d37c6da2924abcca26be348851199480aa2
Instruction Fuzzy Hash: 43D012325141087F9B106BF7BC089567B5DAAC13753240721F52CC51D1DF3AD891AF90

Uniqueness

Uniqueness Score: -1.00%

Function 01055770 Relevance: 3.4, APIs: 2, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0105580F
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 01055B1B

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: a79457bcbe6362e0915fa270478e658ce44b131ff7a557f084c21e2391826f62
Instruction ID: adce045224be88fad2c157c10ecf47726ad24d70fcc56c61160689694d2dea17
Opcode Fuzzy Hash: a79457bcbe6362e0915fa270478e658ce44b131ff7a557f084c21e2391826f62
Instruction Fuzzy Hash: 0CF148B0D002499FDB14CFA8D985BEEFBB1BF48304F244259E945BB341E7756A84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FB9789 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB8E9F: GetConsoleOutputCP.KERNEL32(5479F27D,00000000,00000000,?), ref: 00FB8F02

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00FB990E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00FB9918

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 35608ec09cf017f49b74c22e2bbb310ba4f679e294ca2c29a91c827c896b440c
Instruction ID: 288b471fb904a0cc502d9dc032eb205a69cee3be2e363b9f8b8f9cd7323344e0
Opcode Fuzzy Hash: 35608ec09cf017f49b74c22e2bbb310ba4f679e294ca2c29a91c827c896b440c
Instruction Fuzzy Hash: 0D61C672D08119AFDF11DFA9CC84AEE7FB9AF49314F140149EA04A7246D7B6D901EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01046570 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 010466EA
std::_Throw_Cpp_error.LIBCPMT ref: 010466FB

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 28da8c7dd2b651f5387b9fcdf4d972d0b8dec16f29e47e9779e8b0f774fbe61f
Instruction ID: 553a3b1e9486b160656da48531225e6dc371a71e0785b5c6bbaeaa9f225c09f2
Opcode Fuzzy Hash: 28da8c7dd2b651f5387b9fcdf4d972d0b8dec16f29e47e9779e8b0f774fbe61f
Instruction Fuzzy Hash: 4C41E3B1E002018BD724DF6CD98276EB7F0EB85314F19432EE89557785EB3AAA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FB8DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00FB8CE6,00000000,?,010EA178,0000000C,00FB8DA2,?,?,?), ref: 00FB8E55
GetLastError.KERNEL32(?,00FB8CE6,00000000,?,010EA178,0000000C,00FB8DA2,?,?,?), ref: 00FB8E5F

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 4fe38ba681644c9332d97211262858e31bba07a20e14fe1ca395fea6256e54a2
Instruction ID: bd43b82dde484e58f0a53a436b2fcf1468e872e51635fad02ef61ddd8277236a
Opcode Fuzzy Hash: 4fe38ba681644c9332d97211262858e31bba07a20e14fe1ca395fea6256e54a2
Instruction Fuzzy Hash: 38118833A001105AD63122B7AC467EE3B5D4BC27B4F29061DF8098B1C2DE79C887EA81

Uniqueness

Uniqueness Score: -1.00%

Function 00FB251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,00FB2626,?,?,?,?,?), ref: 00FB2558
GetLastError.KERNEL32(?,?,?,?,00FB2626,?,?,?,?,?,00000000,?,00000000), ref: 00FB2565

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: a805f1ffb1aee27b7b408143640b12e10c28a0c3e18f3784484dc7f9378e372c
Instruction ID: ed7978156b5b3f9fb87f6bdc691098e1ae624d1f65406ac1e580f02a41502972
Opcode Fuzzy Hash: a805f1ffb1aee27b7b408143640b12e10c28a0c3e18f3784484dc7f9378e372c
Instruction Fuzzy Hash: EF01D632610515AFCF258F6ADC259DE7B69EB85330B280208F8519B2A5E671ED41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FBB01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00FC1B48,?,00000000,?,?,00FC1DE9,?,00000007,?,?,00FC22DD,?,?), ref: 00FBB030
GetLastError.KERNEL32(?,?,00FC1B48,?,00000000,?,?,00FC1DE9,?,00000007,?,?,00FC22DD,?,?), ref: 00FBB03B

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: f9fe7ceb201defb179c8f478139195f6e86b28da4cc9323f94f2a8520b361c40
Instruction ID: da03feba97497519ce6b1c45aa48b93051bb0f5c28e5c85998f713f083defca6
Opcode Fuzzy Hash: f9fe7ceb201defb179c8f478139195f6e86b28da4cc9323f94f2a8520b361c40
Instruction Fuzzy Hash: 26E08C32500604ABCB213FAAAC09BDA7B6ABF007A1F548038F60896490CB79CC50EF84

Uniqueness

Uniqueness Score: -1.00%

Function 01037E70 Relevance: 1.9, APIs: 1, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3e652ac1e2d002ac3633e2776921d8d7f7f28e4b02a9d26692d01603419d4b
Instruction ID: 905be0f592146193e2277e0f432a900cd5522654ce5c2c30ebc2fb3f5d2e358c
Opcode Fuzzy Hash: 2b3e652ac1e2d002ac3633e2776921d8d7f7f28e4b02a9d26692d01603419d4b
Instruction Fuzzy Hash: 1E02E070D04248DFDF10EFA8C9467DDBBB4AF45304F1481DDE8496B282DB795A88DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F83D50 Relevance: 1.8, APIs: 1, Instructions: 253COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F84093

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 189ffb34ca1fa5f55efb9d72898b31f296c89109d0459e20447e8bc08e2ef8bf
Instruction ID: 68f27505308f2bd6db185ba8ebcbc6053805e072b848af6002e18b6106a31109
Opcode Fuzzy Hash: 189ffb34ca1fa5f55efb9d72898b31f296c89109d0459e20447e8bc08e2ef8bf
Instruction Fuzzy Hash: 54C137B1D01249DFDB00DFA8C484799FBF0AF09314F28C19AE458AB392D376AA45DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F85350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F8546E

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e41b3ad08b1c953092804a8100cc5a597f3348c11ef2dee340a8f00ccf064e5c
Instruction ID: 1e1222ce8350a061233965b5b37395a1440c5697a85c630c41604af48e4adc84
Opcode Fuzzy Hash: e41b3ad08b1c953092804a8100cc5a597f3348c11ef2dee340a8f00ccf064e5c
Instruction Fuzzy Hash: 2361AAB1A00614DFCB10DF59C984B9ABBF5FF48710F24816EE4199B391C779EA01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA8E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af7a082be36a61fe4ec2dbddb1716b4b7e43f4653cbfd4ec06170d696109678
Instruction ID: f813bf727921c124eb0b36d099aba0ce82830982ec9c388b2dc16e5350669780
Opcode Fuzzy Hash: 8af7a082be36a61fe4ec2dbddb1716b4b7e43f4653cbfd4ec06170d696109678
Instruction Fuzzy Hash: 5E51E8B1A00109EFDF14DF58CC85A997FB2EF46364F248159F8089B252D7B1DE42EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F73130 Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F732B8

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 65459a83e968dddd24fe6ab17bc85c2512ac6e3d52ef237eec4ee773f2e97802
Instruction ID: aa2a33712de9f03d5c9db7d5f111a0dce1df296fca09cd7a3bb9cc51969b9faa
Opcode Fuzzy Hash: 65459a83e968dddd24fe6ab17bc85c2512ac6e3d52ef237eec4ee773f2e97802
Instruction Fuzzy Hash: 6841E8B2E00111AFCB14DF6CC985A6EBBB5EB85310F14822AF819DB345D774DE01EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F99E20 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F99F7B

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8b02c75b27057870071d0e87751384df39613dbade7bfd14633de579beff5c9c
Instruction ID: 1378a2e46fcb2c5cbcacac7b5810439f0a5b5fd659b122952328ac11b6030bb5
Opcode Fuzzy Hash: 8b02c75b27057870071d0e87751384df39613dbade7bfd14633de579beff5c9c
Instruction Fuzzy Hash: 4441F3B2E041049FDF14DF6CC841AAEBBB9EB89310F14422DE814E7381D6749E019BE0

Uniqueness

Uniqueness Score: -1.00%

Function 010575C0 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0105772C

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: f9f25657240a8fd98d901f6309cdc2c4cd61bff56dbaac16a884ec7e9523df7b
Instruction ID: 49af5890423daf08eb197dc8253a095f336c5f960b061b6456c125cf4de11797
Opcode Fuzzy Hash: f9f25657240a8fd98d901f6309cdc2c4cd61bff56dbaac16a884ec7e9523df7b
Instruction Fuzzy Hash: B45158B0D002499BDB20DF98D986BAEFBF4FF44714F14412DE8416B381E7756A44DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01057440 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 01057589

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 76126fd2b75713cee10a8efeeb9794aaa9b8202434bf96354f56ffbed3178377
Instruction ID: 1d6e773b2325cc9a73f499766389af3388c555476c1a1545203ed33fdabac66a
Opcode Fuzzy Hash: 76126fd2b75713cee10a8efeeb9794aaa9b8202434bf96354f56ffbed3178377
Instruction Fuzzy Hash: 2C414BB1D002489FDB00DF98D881BEEBBB4FF49714F544169E815AB381E7799A01DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F76870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00F76908

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: e981e61b1edc05c19f25b709dee2c25c76e24458ff8c63cd91876bc894acf612
Instruction ID: aecf7d47be59b694db402932e654247f33e2db6fa026307e8c2469df617f36ee
Opcode Fuzzy Hash: e981e61b1edc05c19f25b709dee2c25c76e24458ff8c63cd91876bc894acf612
Instruction Fuzzy Hash: 5F218176E00A15ABCB14DF48D841BAEB7B4FB44760F00466AED29A3781DB356D04D792

Uniqueness

Uniqueness Score: -1.00%

Function 01055C80 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(010CD560,00000000,00000000), ref: 01055CC7

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: c775d0f8981cefce9c3d6439aca66a151e092cb531ed51cff2b9f578a04ec2d5
Instruction ID: b91c7309a77fb5fddc8ebad3b07a1d01f670a7c351bf0abd2b24bbc028faa106
Opcode Fuzzy Hash: c775d0f8981cefce9c3d6439aca66a151e092cb531ed51cff2b9f578a04ec2d5
Instruction Fuzzy Hash: 5311CEB1D047449BD7209F18D90675BBBE4EB04B24F10472DE8915B3C1E7B66A448BE2

Uniqueness

Uniqueness Score: -1.00%

Function 00F732D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F7331F

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction ID: 429a21455d87ab8ab8466134a6f52590d021c1c92eae4ff9198545a6cb613c3d
Opcode Fuzzy Hash: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction Fuzzy Hash: A9F02472500100ABDB246F64E8158E9B3F8DF243A1750483BF88CC7612EB2ADA40B782

Uniqueness

Uniqueness Score: -1.00%

Function 00FBA65A Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001), ref: 00FBA69B

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4a6ea97dee795d8ded2306b14a8fc914f51f500c275a12acc4b4f41c7174b783
Instruction ID: 2ef78cdf5ab678e3c38e6b5d00ac78e57f4d580d665c9d996891b26a962ecfce
Opcode Fuzzy Hash: 4a6ea97dee795d8ded2306b14a8fc914f51f500c275a12acc4b4f41c7174b783
Instruction Fuzzy Hash: C2F0BE72A105246F9B256A67DC15BEA374FAF407B0F1C8122FC44EA080DA39DC00AEE6

Uniqueness

Uniqueness Score: -1.00%

Function 00FBB094 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 00FBB0C6

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 40d9d664061f3cd8e38216ca2239260b66fddf6e9b06784424c74aa7abac3bd5
Instruction ID: f08b793a2ccb4c4e99e41c81f4f51c1b1358798c504b5b3deb51561983e9397f
Opcode Fuzzy Hash: 40d9d664061f3cd8e38216ca2239260b66fddf6e9b06784424c74aa7abac3bd5
Instruction Fuzzy Hash: C4E065327006246ADB3137679C11BFB764D9F417F0F154221FD65A65C1DBA8CC10AFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F76840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00F76853

Part of subcall function 00FA1F7B: FindNextFileW.KERNELBASE(?,?,?,00F76858,?,?,?,?,00F7691A,?,?,?,00000000,?,?), ref: 00FA1F84

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction ID: a4d5cab6cc41f4c1e3bc7d6519c46fd855df72c74ef5b5a31a0c96343afb192b
Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction Fuzzy Hash: C5D0C921B04D24111E25752B3D059BF569A4DD7BB4B4580ABB94DD3283EE48CC0770E7

Uniqueness

Uniqueness Score: -1.00%

Function 00FB66D5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FB66DC

Memory Dump Source

Source File: 00000000.00000002.2021619357.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F70000, based on PE: true

Associated: 00000000.00000002.2021598579.0000000000F70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021619357.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021930361.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000124E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.0000000001268000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000012F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.000000000160C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2021955024.00000000018B0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_file.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: ccbd4f81f3f3e9b75030075a509dac97354aca9f58913e75b6e30f5f2617838d
Instruction ID: 2043657ec6cf317376d6b431587f057e9dc90dde96eaaa64d78e491f735b51d9
Opcode Fuzzy Hash: ccbd4f81f3f3e9b75030075a509dac97354aca9f58913e75b6e30f5f2617838d
Instruction Fuzzy Hash: 21E075B6D1020DAADB04EFD4C842BEFBBB8AB08314F504066A205E6141EB7897459BA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_f22e2bf49a32bf74f5adbe8cba848017948e65f7_0010bad0_640263cb-49b4-41b7-b487-4b818315d5ea\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d8cfe4b0b9575b2ab71f14e55e4d6484872cb94_df5fde7b_aa9d6a92-8d2d-4559-99fe-1b134b7dfc56\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d8cfe4b0b9575b2ab71f14e55e4d6484872cb94_df5fde7b_f3afe759-c551-431a-a54b-014b05a40ae0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_751fa919568148cae58711204775ef674bafd71f_50e30abd_2c1d9ae0-1b69-4126-ae64-d738448a55b5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER144F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16F0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER172F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER220B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2333.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2334.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2364.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER242E.tmp.WERInternalMetadata.xml

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre