Edit tour

Windows Analysis Report
bUHMq54m6Q.exe

Overview

General Information

Sample name:	bUHMq54m6Q.exe renamed because original name is a hash value
Original sample name:	2cf4b5cf327757376e717ab5554b921b.exe
Analysis ID:	1437130
MD5:	2cf4b5cf327757376e717ab5554b921b
SHA1:	020751e48f382dbd25341228e0acf66818428b12
SHA256:	a275c369ef53eba4655ca43244e230fd7b38e45dbf25fc0b614918a58b3d07a6
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

bUHMq54m6Q.exe (PID: 6556 cmdline: "C:\Users\user\Desktop\bUHMq54m6Q.exe" MD5: 2CF4B5CF327757376E717AB5554B921B)

schtasks.exe (PID: 3560 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5412 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 1836 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 1888 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 4896 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 2CF4B5CF327757376E717AB5554B921B)

WerFault.exe (PID: 5088 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1148 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 2836 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 2CF4B5CF327757376E717AB5554B921B)

RageMP131.exe (PID: 3604 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 2CF4B5CF327757376E717AB5554B921B)

RageMP131.exe (PID: 5700 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 2CF4B5CF327757376E717AB5554B921B)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\NoSoV6eJxRbhlNXMC2XnYgm.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\eK26yDxmyAbMrjg7CdmfOmj.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2159759925.0000000005C56000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2276746268.000000000122E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2280792333.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.2282419782.0000000005A70000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: bUHMq54m6Q.exe PID: 6556	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: bUHMq54m6Q.exe PID: 6556	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 4896	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 4896	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 2836	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 3604	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 5700	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\bUHMq54m6Q.exe, ProcessId: 6556, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.6

Timestamp:	05/07/24-01:32:16.104894
SID:	2046266
Source Port:	58709
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.6

Timestamp:	05/07/24-01:32:30.432420
SID:	2046266
Source Port:	58709
Destination Port:	49720
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.6

Timestamp:	05/07/24-01:32:13.660877
SID:	2046266
Source Port:	58709
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.6

Timestamp:	05/07/24-01:32:13.858546
SID:	2046267
Source Port:	58709
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.6

Timestamp:	05/07/24-01:32:16.124524
SID:	2046266
Source Port:	58709
Destination Port:	49702
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.6 - Destination IP: 147.45.47.126

Timestamp:	05/07/24-01:32:13.477244
SID:	2049060
Source Port:	49699
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.6 - Destination IP: 147.45.47.126

Timestamp:	05/07/24-01:32:19.524067
SID:	2046269
Source Port:	49699
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.6

Timestamp:	05/07/24-01:32:39.555621
SID:	2046266
Source Port:	58709
Destination Port:	49724
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://147.45.47.102:57893/hera/amadka.exe

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 47%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: bUHMq54m6Q.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005D6A80 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_005D6A80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FC6A80 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		6_2_00FC6A80

Source: bUHMq54m6Q.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49726 version: TLS 1.2

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005F66F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_005F66F0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A3EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_005A3EC0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005EFE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_005EFE80
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00541F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00541F9C
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005D5F80 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_005D5F80
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00542022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00542022
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A3850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_005A3850
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FE66F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	6_2_00FE66F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F93EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	6_2_00F93EC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FDFE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	6_2_00FDFE80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F31F9C FindClose,FindFirstFileExW,GetLastError,	6_2_00F31F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FC5F80 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_00FC5F80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F32022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_00F32022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F93850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_00F93850

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.6:49699 -> 147.45.47.126:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.6:49699
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.126:58709 -> 192.168.2.6:49699
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.6:49703
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.6:49702
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.6:49699 -> 147.45.47.126:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.6:49720
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.6:49724

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.126 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.6:49699 -> 147.45.47.126:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.126 147.45.47.126
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.126

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Code function: 0_2_005D8510 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,FreeAddrInfoW,WSACleanup,FreeAddrInfoW,

0_2_005D8510

Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/156.146.37.102 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=156.146.37.102 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158606160.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158405940.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158512133.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: bUHMq54m6Q.exe, 00000000.00000003.2158606160.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158405940.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158512133.0000000005C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe)=
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe68.0
Source: MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeaO
Source: MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.23
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158606160.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158512133.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exe
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exe207
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exeServer
Source: bUHMq54m6Q.exe, 00000000.00000003.2158606160.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158512133.0000000005C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exeTerracoin=
Source: MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exeWOUl-
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exe
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: bUHMq54m6Q.exe, 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2086040857.0000000001180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2114405302.0000000000C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2277258884.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000002.2168458625.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2114630366.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2324438250.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000E.00000003.2255008440.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2427181585.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 00000012.00000003.2337606735.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102
Source: RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102D
Source: MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102LS
Source: RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102_i
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=156.146.37.102
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=156.146.37.102A
Source: bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 00000012.00000002.2429829682.0000000001180000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.0000000001172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/$E
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.000000000129C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/e7
Source: bUHMq54m6Q.exe, 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2086040857.0000000001180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2114405302.0000000000C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2277258884.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000002.2168458625.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2114630366.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2324438250.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000E.00000003.2255008440.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2427181585.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 00000012.00000003.2337606735.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RageMP131.exe, 0000000E.00000002.2325536566.00000000010C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/o
Source: MPGPH131.exe, 00000007.00000002.2174199079.0000000001C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/t
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2276746268.000000000126C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001C6F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010AC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.0000000001190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/156.146.37.102
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/156.146.37.102=
Source: RageMP131.exe, 0000000E.00000002.2325536566.00000000010AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/156.146.37.102d
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/156.146.37.102p
Source: MPGPH131.exe, 00000007.00000002.2174199079.0000000001C27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/x
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/156.146.37.102
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2276746268.000000000122E000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2282419782.0000000005A70000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001C27000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.000000000105E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.0000000001147000.00000004.00000020.00020000.00000000.sdmp, NoSoV6eJxRbhlNXMC2XnYgm.zip.6.dr, eK26yDxmyAbMrjg7CdmfOmj.zip.0.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: RageMP131.exe, 00000012.00000002.2429829682.0000000001147000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT2
Source: MPGPH131.exe, 00000006.00000002.2282419782.0000000005A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT=L
Source: bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTBB~
Source: bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTP
Source: RageMP131.exe, 0000000E.00000002.2325536566.000000000105E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTPROCESSOR_LEVEL=6PROCES
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.000000000122E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTf
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTq3i
Source: RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.000000000121F000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr, passwords.txt.6.dr	String found in binary or memory: https://t.me/risepro_bot
Source: RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot7.102
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botPrim
Source: MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot_Aj
Source: RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botr5
Source: RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisep
Source: RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro
Source: MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro;O
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botz
Source: bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: bUHMq54m6Q.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr, 3b6N2Xdh3CYwplaces.sqlite.7.dr, D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://www.mozilla.org#
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: D87fZN3R3jFeplaces.sqlite.7.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49726 version: TLS 1.2

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Code function: 0_2_005F5F70 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,701574A0,DeleteObject,DeleteObject,ReleaseDC,

0_2_005F5F70

System Summary

PE file contains section with special chars

Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005AF050	0_2_005AF050
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0055002D	0_2_0055002D
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005BA180	0_2_005BA180
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A6330	0_2_005A6330
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005AD320	0_2_005AD320
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A03C0	0_2_005A03C0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005EE3B0	0_2_005EE3B0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0064F480	0_2_0064F480
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005E7580	0_2_005E7580
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A8630	0_2_005A8630
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0051B8E0	0_2_0051B8E0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00591B90	0_2_00591B90
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0060AC30	0_2_0060AC30
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A3EC0	0_2_005A3EC0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005AAEE0	0_2_005AAEE0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005EFE80	0_2_005EFE80
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005EEFB0	0_2_005EEFB0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A3000	0_2_005A3000
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005471A0	0_2_005471A0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005B42A0	0_2_005B42A0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0055036F	0_2_0055036F
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00594560	0_2_00594560
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_006585F0	0_2_006585F0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005B3590	0_2_005B3590
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0053F580	0_2_0053F580
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00657690	0_2_00657690
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005F7760	0_2_005F7760
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005647BF	0_2_005647BF
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0054C960	0_2_0054C960
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0054A928	0_2_0054A928
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0055DA86	0_2_0055DA86
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00568BB0	0_2_00568BB0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005FEBA0	0_2_005FEBA0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005FFBA0	0_2_005FFBA0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00644C70	0_2_00644C70
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00656C50	0_2_00656C50
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00655D10	0_2_00655D10
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00651E30	0_2_00651E30
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00568E30	0_2_00568E30
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00602F30	0_2_00602F30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F9F050	6_2_00F9F050
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F4002D	6_2_00F4002D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FAA180	6_2_00FAA180
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F903C0	6_2_00F903C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FDE3B0	6_2_00FDE3B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F96330	6_2_00F96330
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F9D320	6_2_00F9D320
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FD7580	6_2_00FD7580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0103F480	6_2_0103F480
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F98630	6_2_00F98630
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F0B8E0	6_2_00F0B8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F81B90	6_2_00F81B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_01045D10	6_2_01045D10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FFAC30	6_2_00FFAC30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F9AEE0	6_2_00F9AEE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F93EC0	6_2_00F93EC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FDFE80	6_2_00FDFE80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FDEFB0	6_2_00FDEFB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F93000	6_2_00F93000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F371A0	6_2_00F371A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FA42A0	6_2_00FA42A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F4036F	6_2_00F4036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_010485F0	6_2_010485F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FA3590	6_2_00FA3590
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F2F580	6_2_00F2F580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F84560	6_2_00F84560
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F547BF	6_2_00F547BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_01047690	6_2_01047690
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FE7760	6_2_00FE7760
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F3C960	6_2_00F3C960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F3A928	6_2_00F3A928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F3AAEF	6_2_00F3AAEF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F4DA86	6_2_00F4DA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F58BB0	6_2_00F58BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FEEBA0	6_2_00FEEBA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FEFBA0	6_2_00FEFBA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_01046C50	6_2_01046C50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_01034C70	6_2_01034C70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F58E30	6_2_00F58E30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_01041E30	6_2_01041E30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FF2F30	6_2_00FF2F30

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: String function: 0052ACE0 appears 86 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00F1ACE0 appears 86 times

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 1888

Source: bUHMq54m6Q.exe	Static PE information: Number of sections : 12 > 10
Source: RageMP131.exe.0.dr	Static PE information: Number of sections : 12 > 10
Source: MPGPH131.exe.0.dr	Static PE information: Number of sections : 12 > 10

Source: bUHMq54m6Q.exe	Binary or memory string: OriginalFilename vs bUHMq54m6Q.exe
Source: bUHMq54m6Q.exe, 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs bUHMq54m6Q.exe
Source: bUHMq54m6Q.exe, 00000000.00000003.2086143976.0000000001110000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs bUHMq54m6Q.exe
Source: bUHMq54m6Q.exe, 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs bUHMq54m6Q.exe
Source: bUHMq54m6Q.exe	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs bUHMq54m6Q.exe

Source: bUHMq54m6Q.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: bUHMq54m6Q.exe	Static PE information: Section: ZLIB complexity 1.000030517578125
Source: bUHMq54m6Q.exe	Static PE information: Section: ZLIB complexity 0.9986979166666666
Source: bUHMq54m6Q.exe	Static PE information: Section: ZLIB complexity 0.9992461622807017
Source: bUHMq54m6Q.exe	Static PE information: Section: ZLIB complexity 0.9952713815789473
Source: bUHMq54m6Q.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 1.000030517578125
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9986979166666666
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9992461622807017
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9952713815789473
Source: RageMP131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 1.000030517578125
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9986979166666666
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9992461622807017
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9952713815789473
Source: MPGPH131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/58@3/3

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Code function: 0_2_005EFE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_005EFE80

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4412:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6556
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4896

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: bUHMq54m6Q.exe, 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2086040857.0000000001180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2114405302.0000000000C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2277258884.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000002.2168458625.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2114630366.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2324438250.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000E.00000003.2255008440.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2427181585.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 00000012.00000003.2337606735.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: bUHMq54m6Q.exe, 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2086040857.0000000001180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2114405302.0000000000C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2277258884.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000002.2168458625.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2114630366.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2324438250.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000E.00000003.2255008440.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2427181585.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 00000012.00000003.2337606735.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: MPGPH131.exe, 00000006.00000003.2179282683.0000000005EE4000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2178981488.0000000005EE3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179140207.0000000005EE9000.00000004.00000020.00020000.00000000.sdmp, JEr8lVONTEQKLogin Data.0.dr, IuMVYmRLxIIELogin Data.6.dr, 1oBLao5WFReeLogin Data For Account.6.dr, W4StvYRvRm8RLogin Data.6.dr, lKkvrLBG06UiLogin Data For Account.0.dr, wib805ADjjQsLogin Data.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: bUHMq54m6Q.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

File read: C:\Users\user\Desktop\bUHMq54m6Q.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\bUHMq54m6Q.exe "C:\Users\user\Desktop\bUHMq54m6Q.exe"
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 1888
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1148
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: bUHMq54m6Q.exe

Static file information: File size 2298896 > 1048576

Source: bUHMq54m6Q.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x187400

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Code function: 0_2_005DF200 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_005DF200

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: bUHMq54m6Q.exe	Static PE information: section name:
Source: bUHMq54m6Q.exe	Static PE information: section name: .vm_sec
Source: bUHMq54m6Q.exe	Static PE information: section name: .themida
Source: bUHMq54m6Q.exe	Static PE information: section name: .boot
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .vm_sec
Source: RageMP131.exe.0.dr	Static PE information: section name: .themida
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .vm_sec
Source: MPGPH131.exe.0.dr	Static PE information: section name: .themida
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_008A7399 push 4F494312h; mov dword ptr [esp], ecx	0_2_009806B5
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_008A7399 push eax; mov dword ptr [esp], esi	0_2_009806FA
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_008A7399 push 02A74018h; mov dword ptr [esp], ebx	0_2_00980773
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00989680 push ebx; mov dword ptr [esp], esi	0_2_0098968C
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00989680 push 03F40937h; mov dword ptr [esp], eax	0_2_009896CD
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00543F59 push ecx; ret	0_2_00543F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_01297399 push 4F494312h; mov dword ptr [esp], ecx	6_2_013706B5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_01297399 push eax; mov dword ptr [esp], esi	6_2_013706FA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_01297399 push 02A74018h; mov dword ptr [esp], ebx	6_2_01370773
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F33F59 push ecx; ret	6_2_00F33F6C

Source: bUHMq54m6Q.exe	Static PE information: section name: entropy: 7.99965539534534
Source: bUHMq54m6Q.exe	Static PE information: section name: .boot entropy: 7.954415800190369
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.99965539534534
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot entropy: 7.954415800190369
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.99965539534534
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot entropy: 7.954415800190369

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-53509
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-53523
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-53625

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 4596

Thread sleep count: 84 > 30

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005F66F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_005F66F0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A3EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_005A3EC0
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005EFE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_005EFE80
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00541F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00541F9C
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005D5F80 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_005D5F80
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00542022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00542022
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A3850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_005A3850
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FE66F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	6_2_00FE66F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F93EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	6_2_00F93EC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FDFE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	6_2_00FDFE80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F31F9C FindClose,FindFirstFileExW,GetLastError,	6_2_00F31F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FC5F80 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_00FC5F80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F32022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_00F32022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F93850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_00F93850

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

0_2_005EFE80

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.000000000127C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&o
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: bUHMq54m6Q.exe, 00000000.00000003.2160079403.0000000001315000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ngineer\AppData\Local\NVIDIA Corporation\NVIDIA GeForce Experience\*
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2276746268.000000000127C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001C74000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010AC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.0000000001190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: MPGPH131.exe, 00000006.00000003.2182140475.0000000005EDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZ
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RageMP131.exe, 00000012.00000003.2364897264.00000000011A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: MPGPH131.exe, 00000007.00000002.2174199079.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: MPGPH131.exe, 00000006.00000002.2276365511.0000000000D98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}User Data\ilgcnhelpchnceeipipijaljkblbcobl\CURRENT
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: MPGPH131.exe, 00000006.00000002.2276365511.0000000000D98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ox\Profiles\2o7hffxt.default-release\places.sqlite
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}d-
Source: bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_5C8B5E08taw
Source: RageMP131.exe, 0000000E.00000003.2273653876.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}L
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: RageMP131.exe, 00000012.00000002.2429829682.0000000001190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: RageMP131.exe, 00000012.00000002.2429829682.00000000011A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}User Data\WorkspacesNavigationComponent\Network\*(
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: RageMP131.exe, 00000012.00000002.2429829682.00000000011A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: MPGPH131.exe, 00000006.00000003.2188025250.0000000005F0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware~
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: MPGPH131.exe, 00000006.00000002.2276365511.0000000000D98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_5C8B5E08
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: MPGPH131.exe, 00000006.00000003.2130373054.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}/
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Bs1Rik95T3UPWeb Data.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Code function: 0_2_00548A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00548A64

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

0_2_005DF200

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005D6D00 mov eax, dword ptr fs:[00000030h]	0_2_005D6D00
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005A3EC0 mov eax, dword ptr fs:[00000030h]	0_2_005A3EC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FC6D00 mov eax, dword ptr fs:[00000030h]	6_2_00FC6D00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F93EC0 mov eax, dword ptr fs:[00000030h]	6_2_00F93EC0

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Code function: 0_2_005F99F0 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

0_2_005F99F0

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_0054451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0054451D
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_00548A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00548A64
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F3451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00F3451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00F38A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00F38A64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: 0_2_005DF200 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_005DF200
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00FCF200 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		6_2_00FCF200

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_005EFE80
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: GetLocaleInfoW,	0_2_005631CA
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: EnumSystemLocalesW,	0_2_0055B1B1
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_005632F3
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: GetLocaleInfoW,	0_2_005633F9
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_005634CF
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: GetLocaleInfoW,	0_2_0055B734
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00562B5A
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: GetLocaleInfoW,	0_2_00562D5F
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: EnumSystemLocalesW,	0_2_00562E51
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: EnumSystemLocalesW,	0_2_00562E06
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: EnumSystemLocalesW,	0_2_00562EEC
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00562F77
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	6_2_00FDFE80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_00F531CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00F4B1B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00F532F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_00F533F9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00F534CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_00F4B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_00F52B5A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_00F52D5F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00F52EEC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00F52E51
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00F52E06
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00F52F77

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

0_2_005EFE80

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

0_2_005EFE80

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

0_2_005EFE80

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000003.2159759925.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2276746268.000000000122E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280792333.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2282419782.0000000005A70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bUHMq54m6Q.exe PID: 6556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 3604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\NoSoV6eJxRbhlNXMC2XnYgm.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\eK26yDxmyAbMrjg7CdmfOmj.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets#
Source: bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx
Source: bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: bUHMq54m6Q.exe, 00000000.00000003.2158606160.0000000005C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\places.sqlite	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\bUHMq54m6Q.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: Process Memory Space: bUHMq54m6Q.exe PID: 6556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4896, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000003.2159759925.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2276746268.000000000122E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280792333.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2282419782.0000000005A70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bUHMq54m6Q.exe PID: 6556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 3604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\NoSoV6eJxRbhlNXMC2XnYgm.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\eK26yDxmyAbMrjg7CdmfOmj.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Virtualization/Sandbox Evasion	Cached Domain Credentials	351 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	13 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
bUHMq54m6Q.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	47%	ReversingLabs	Win32.Trojan.RiseProStealer
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	47%	ReversingLabs	Win32.Trojan.RiseProStealer

Source	Detection	Scanner	Label
http://crl.micro	0%	URL Reputation	safe
http://193.233.132.56/cost/go.exe207	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe68.0	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exeaO	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.exeWOUl-	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.exeServer	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe)=	0%	Avira URL Cloud	safe
http://193.23	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe	100%	Avira URL Cloud	malware
http://193.233.132.56/cost/go.exeTerracoin=	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.exe	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.4.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://db-ip.com/demo/home.php?s=156.146.37.102	false		high
https://ipinfo.io/widget/demo/156.146.37.102	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	false		high
https://duckduckgo.com/ac/?q=	bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	false		high
http://193.233.132.56/cost/go.exe207	bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=156.146.37.102D	RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/156.146.37.102p	MPGPH131.exe, 00000006.00000002.2275133356.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe	bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158606160.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158405940.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158512133.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://db-ip.com/	RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTBB~	bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTf	bUHMq54m6Q.exe, 00000000.00000002.2276746268.000000000122E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe68.0	MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	false		high
https://t.me/risepro_bot7.102	RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTq3i	MPGPH131.exe, 00000006.00000002.2275133356.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botr5	RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/156.146.37.102d	RageMP131.exe, 0000000E.00000002.2325536566.00000000010AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/x	MPGPH131.exe, 00000007.00000002.2174199079.0000000001C27000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/go.exe	bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158606160.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158512133.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=156.146.37.102_i	RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/e7	bUHMq54m6Q.exe, 00000000.00000002.2276746268.000000000129C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/o	RageMP131.exe, 0000000E.00000002.2325536566.00000000010C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTP	bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	false		high
https://ipinfo.io/t	MPGPH131.exe, 00000007.00000002.2174199079.0000000001C5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTPROCESSOR_LEVEL=6PROCES	RageMP131.exe, 0000000E.00000002.2325536566.000000000105E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botisepro_bot_Aj	MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botrisepro	RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/go.exeTerracoin=	bUHMq54m6Q.exe, 00000000.00000003.2158606160.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158512133.0000000005C71000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=156.146.37.102LS	MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	false		high
https://ipinfo.io/widget/demo/156.146.37.102=	MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT2	RageMP131.exe, 00000012.00000002.2429829682.0000000001147000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botPrim	MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botrisep	RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT=L	MPGPH131.exe, 00000006.00000002.2282419782.0000000005A70000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	bUHMq54m6Q.exe, 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2086040857.0000000001180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2114405302.0000000000C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2277258884.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000002.2168458625.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2114630366.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2324438250.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000E.00000003.2255008440.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2427181585.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 00000012.00000003.2337606735.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	false		high
http://upx.sf.net	Amcache.hve.10.dr	false		high
https://t.me/RiseProSUPPORT	bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2276746268.000000000122E000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2282419782.0000000005A70000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001C27000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.000000000105E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.0000000001147000.00000004.00000020.00020000.00000000.sdmp, NoSoV6eJxRbhlNXMC2XnYgm.zip.6.dr, eK26yDxmyAbMrjg7CdmfOmj.zip.0.dr	false		high
https://www.ecosia.org/newtab/	bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	false		high
https://ipinfo.io/Mozilla/5.0	bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/156.146.37.102	bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.7.dr	false		high
http://193.233.132.56/cost/go.exeServer	MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.102:57893/hera/amadka.exe)=	bUHMq54m6Q.exe, 00000000.00000003.2158606160.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2159759925.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158405940.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000002.2280792333.0000000005C73000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2158512133.0000000005C71000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=156.146.37.102A	bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/go.exeWOUl-	MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	false		high
https://t.me/risepro_bot	RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.000000000121F000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr, passwords.txt.6.dr	false		high
http://147.45.47.102:57893/hera/amadka.exeaO	MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.23	MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://crl.micro	MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/	RageMP131.exe, 00000012.00000002.2429829682.0000000001180000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.0000000001172000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	D87fZN3R3jFeplaces.sqlite.7.dr	false		high
https://www.maxmind.com/en/locate-my-ip-address	bUHMq54m6Q.exe, MPGPH131.exe	false		high
https://t.me/risepro_botz	bUHMq54m6Q.exe, 00000000.00000002.2276746268.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/lenin.exe	MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	bUHMq54m6Q.exe, 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2086040857.0000000001180000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2114405302.0000000000C50000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2277258884.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000002.2168458625.000000000105D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2114630366.0000000001A50000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2324438250.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 0000000E.00000003.2255008440.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2427181585.00000000004BD000.00000002.00000001.01000000.00000008.sdmp, RageMP131.exe, 00000012.00000003.2337606735.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.7.dr	false		high
https://t.me/risepro_botrisepro;O	MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com:443/demo/home.php?s=156.146.37.102	MPGPH131.exe, 00000006.00000002.2275133356.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2174199079.0000000001CA7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000E.00000002.2325536566.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000012.00000002.2429829682.00000000011BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/$E	MPGPH131.exe, 00000006.00000002.2275133356.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	bUHMq54m6Q.exe, 00000000.00000003.2150265902.0000000005C6F000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2152690333.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, bUHMq54m6Q.exe, 00000000.00000003.2151263071.0000000005C92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181530040.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2179554394.0000000005EFB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2180030463.0000000005F00000.00000004.00000020.00020000.00000000.sdmp, RVFvq_w1ZQYbWeb Data.0.dr, 9V16nhm0bFZXWeb Data.0.dr, LmI4gt7uNt6lWeb Data.0.dr, uH4Klb1syK8iWeb Data.6.dr, KsIfLLPbfavZWeb Data.6.dr, e0WJiscSE76mWeb Data.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.126	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1437130
Start date and time:	2024-05-07 01:31:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bUHMq54m6Q.exe renamed because original name is a hash value
Original Sample Name:	2cf4b5cf327757376e717ab5554b921b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@13/58@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 67% Number of executed functions: 51 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: bUHMq54m6Q.exe

Simulations

Behavior and APIs

Time	Type	Description
01:32:12	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
01:32:13	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
01:32:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
01:32:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
01:32:28	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.126	STaz6G7t52.exe	Get hash	malicious	RisePro Stealer	Browse
	8A1Qvcfs13.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc	Browse
	LFnwvV2we8.exe	Get hash	malicious	RisePro Stealer	Browse
	586785f2da723d2d03daabb7c1525d59b775ef6205fa4.exe	Get hash	malicious	RisePro Stealer	Browse
	ec1c11e1a15be3e6d208777f69ffe6176356cba61ee06.exe	Get hash	malicious	RisePro Stealer	Browse
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	STaz6G7t52.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	LFnwvV2we8.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	586785f2da723d2d03daabb7c1525d59b775ef6205fa4.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	ec1c11e1a15be3e6d208777f69ffe6176356cba61ee06.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	wud36BhZfU.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	OJa1BOigU3.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	34.117.186.192
	OJa1BOigU3.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://reactivate-account.live/	Get hash	malicious	Unknown	Browse	34.117.186.192
	wNyot4Puq5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.186.192
db-ip.com	STaz6G7t52.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	LFnwvV2we8.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	586785f2da723d2d03daabb7c1525d59b775ef6205fa4.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	ec1c11e1a15be3e6d208777f69ffe6176356cba61ee06.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	wud36BhZfU.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	OJa1BOigU3.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	104.26.5.15
	OJa1BOigU3.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://windowsprogramdangererrorfoundcritical.kesug.com/?i=3	Get hash	malicious	Unknown	Browse	34.117.185.41
	STaz6G7t52.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	8A1Qvcfs13.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc	Browse	34.117.186.192
	LFnwvV2we8.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	586785f2da723d2d03daabb7c1525d59b775ef6205fa4.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	ec1c11e1a15be3e6d208777f69ffe6176356cba61ee06.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	wud36BhZfU.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://u.to/rh6dIA	Get hash	malicious	Unknown	Browse	34.117.121.53
	MDE_File_Sample_1fd07379ca528bc6536b2053dddc3ea7bf85e268 (1).zip	Get hash	malicious	Flawedammyy	Browse	34.117.188.166
FREE-NET-ASFREEnetEU	STaz6G7t52.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.126
	8A1Qvcfs13.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc	Browse	147.45.47.126
	LFnwvV2we8.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.126
	586785f2da723d2d03daabb7c1525d59b775ef6205fa4.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.126
	ec1c11e1a15be3e6d208777f69ffe6176356cba61ee06.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.126
	wud36BhZfU.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	OJa1BOigU3.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	193.233.132.253
	OJa1BOigU3.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.226
	9vZbHuuOq6.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.253
CLOUDFLARENETUS	SecuriteInfo.com.Win32.PWSX-gen.22265.6346.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://share-field-7570.yralecaeaghnrsn.workers.dev/55dbf939-4f12-4e1	Get hash	malicious	Unknown	Browse	104.21.54.88
	https://cloude-15e5.karsonjacobsen.workers.dev/d2d7e935-4585-4825-8391-46e4c9be230d	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://pub-b21d18de3a374246bba2ba1405261622.r2.dev/credential_update-now.html	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
	https://windowsprogramdangererrorfoundcritical.kesug.com/?i=3	Get hash	malicious	Unknown	Browse	104.20.201.67
	https://clous-lab-662a.tlavaeonryersvs.workers.dev/03076ce1-7441-4494-9b6c-c6311d88e918	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://pub-77d30b86b0c442ffa3b4972e714f3fdf.r2.dev/index2.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://a0sreadn.surge.sh/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://bafkreid2sritou3nqmvs5fyoqdftsbfaxa5ovsyzipxhkplqmbp7ihau2y.ipfs.cf-ipfs.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	SecuriteInfo.com.Win32.TrojanX-gen.30104.20010.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	STaz6G7t52.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	LFnwvV2we8.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	586785f2da723d2d03daabb7c1525d59b775ef6205fa4.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	ec1c11e1a15be3e6d208777f69ffe6176356cba61ee06.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	wud36BhZfU.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	May-Document-6_2024-5062.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	May-Document-6_2024-8723.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	May-Document-6_2024-3471.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	May-Document-6_2024-5011.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	May-Document-6_2024-7381.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2298896
Entropy (8bit):	7.943949707127546
Encrypted:	false
SSDEEP:	49152:JZZ2yJFMXgNp/R21ABbgdThoxEN2lcHmNNQfwo:JZZF7N1ROABbgdThog24fwo
MD5:	2CF4B5CF327757376E717AB5554B921B
SHA1:	020751E48F382DBD25341228E0ACF66818428B12
SHA-256:	A275C369EF53EBA4655CA43244E230FD7B38E45DBF25FC0B614918A58B3D07A6
SHA-512:	CECCBEAF87660EA08D9BDC5804546C16A2ABEA4F73C8F80345E711CF5C4A8AB9330CA64022B890457187BDE83DE2687177CB50C1A4FC1BF9D49054510E2418FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....96f...............'............X`P...........@...........................h......#...@..................................Q.......p........................h..............................`...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@... .........r..................@..@ X....p...L...D..............@..B.vm_sec..@.......@..................@....idata.......P......................@....tls.........`...........................rsrc........p......................@..@.themida. 5..@......................`....boot....t...`P..t..................`..`.reloc........h.......#.

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_5ae7e4c267f7e8254d33e44a3aef75514fc3925e_0010bad0_310ee076-0e1e-4dc2-a821-22b2cb294147\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0528304363184986
Encrypted:	false
SSDEEP:	192:QKlcZzR8D107ETl6E6jjyZrofxjPzuiFGZ24IO826t:t2ReW7ET4jLPzuiFGY4IO8p
MD5:	55FFA6AEB68627E18595895A40485121
SHA1:	AE5696883F3C06E49D31DAB177D1223C6B39CFC4
SHA-256:	859047D27DE298B2397FF427B2C29AF186EA31070DE9401F1C329CD172538B29
SHA-512:	2E80144AC3251CA2BB9172822638597460BF76D3AFD7EE184AFFC904EA3B6E3109113FB3A23DA9A9EB9575F6D1D3BA455A4FF6004464D654BE28A285BDFB11D8
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.5.1.1.9.4.4.6.4.0.4.1.8.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.5.1.1.9.4.7.3.7.4.7.9.2.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.0.e.e.0.7.6.-.0.e.1.e.-.4.d.c.2.-.a.8.2.1.-.2.2.b.2.c.b.2.9.4.1.4.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.5.d.0.5.d.5.-.3.0.6.1.-.4.1.2.9.-.b.2.8.3.-.c.d.1.2.b.c.0.3.2.a.6.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.2.0.-.0.0.0.1.-.0.0.1.5.-.1.c.2.f.-.5.e.9.f.0.d.a.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.0.2.0.7.5.1.e.4.8.f.3.8.2.d.b.d.2.5.3.4.1.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bUHMq54m6Q.exe_7f5678ff3d44ce164b9187a831663245298324_7fe652d7_b9d6888b-1509-4a56-aeb6-1b74ada72881\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0564993166343377
Encrypted:	false
SSDEEP:	192:kz2FyGpe0AYvcjyZrosLZuzuiFGZ24IO8w:DFyGpFAYvcjyuzuiFGY4IO8w
MD5:	2496724ADC3F946A9EC4B66BA7F8E3AF
SHA1:	413DB74471545DB74251D665B0E2655A98368916
SHA-256:	1E7358379E3E413E7E0B108224F599DA60E1D0ED170F5589194853F8B52601B7
SHA-512:	24698623A0845B1E59CC4229900A1CABDE1FB8536D0D869AC4F2B36BB2129D2C945B4792966B41CFFEB6854C34193AA13EEEA0EEB9E4E0900225A9D41B80EC3F
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.5.1.1.9.4.1.3.6.0.7.6.5.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.5.1.1.9.4.2.2.2.0.1.4.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.9.d.6.8.8.8.b.-.1.5.0.9.-.4.a.5.6.-.a.e.b.6.-.1.b.7.4.a.d.a.7.2.8.8.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.5.f.d.3.c.5.f.-.9.2.a.3.-.4.a.c.1.-.9.2.8.f.-.3.f.d.9.c.e.1.f.1.b.7.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.U.H.M.q.5.4.m.6.Q...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.r.o.s.s.D.e.v.i.c.e.S.e.t.t.i.n.g.s.H.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.9.c.-.0.0.0.1.-.0.0.1.5.-.9.5.8.0.-.b.d.9.d.0.d.a.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.6.7.a.b.c.f.8.d.6.c.2.5.2.9.7.e.d.9.7.2.3.e.f.1.6.c.3.8.f.3.6.0.0.0.0.0.9.1.0.!.0.0.0.0.0.2.0.7.5.1.e.4.8.f.3.8.2.d.b.d.2.5.3.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FC2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon May 6 23:32:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	121480
Entropy (8bit):	1.855363340823153
Encrypted:	false
SSDEEP:	384:DD+AADAd0Ftvk7wkhOv0YASdEGG3qAJzlZI0BaQfK+rF9z2:DD+he0FtvcU0YASrobaE9z
MD5:	D265223288CCD39728494EDACC4D45CD
SHA1:	4EC0FD691CD4E11EAD031D358DCFBF6A5C1E79E1
SHA-256:	3A1EE8B072CC72BC32AEDC6A301DC67B033B20CB4F6E4606AF43E0611AA6027A
SHA-512:	19C823276AD1500C61CE121857EC766FED99485B43E0491417FAEDFEE9A8630BEEEDAF7C4AB0B3F2000ABAF116B28B34B5C0C1D724A8E9A339B268B7A071117F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........h9f............................(.......l....#...........O..........`.......8...........T...........HJ..@...........,$...........&..............................................................................eJ.......&......GenuineIntel............T...........zh9f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3215.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.708401782548626
Encrypted:	false
SSDEEP:	192:R6l7wVeJBM6GKrP56Y2DDSU/yAgmfsJlyprw89btOsfKEPm:R6lXJ66PP56YeSUqAgmfsJlKtNfK
MD5:	BFF72A7437A4CFE9B3A33B115D4942B4
SHA1:	8296D052352D269EADE7E733B3B1C6BE03531913
SHA-256:	AE160FD624E0970377AF57CA774FAFDFCBF04F5819A2538C99F29860D75D9418
SHA-512:	4A2CEDDC0AAEB1DEEE590F581DD15059DDC4CCDA200452DD43A4B87F3312B30FC318DB4ACF2614B0C086B50272B47CF640A544BBA6678163593815AE84D8D967
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3245.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4728
Entropy (8bit):	4.5356433746061215
Encrypted:	false
SSDEEP:	48:cvIwWl8zshQJg77aI9rCBWpW8VYAYm8M4JkNFN9z+q8Yf5+EQyffd:uIjfsI74Q7VgJqzRPQynd
MD5:	D52E3C37BBCBDD516F70697AC8B54A96
SHA1:	975DE1864954B059C8D6F50837E9526627C2FCB3
SHA-256:	28435826EB843D3C8F5F29C60181A36224782383BCF8B26141C324E232324EC2
SHA-512:	5D1673CA7EE38D7C0EEC780AD44D501F8E467C611ED38B8AA202ECEC840F74607DC02E2EB70CE07E8C01FEFC058CD92208AC0B2961CE00C2F21C7166BEF8E07A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="311915" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C94.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon May 6 23:32:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	110138
Entropy (8bit):	1.9059204889344317
Encrypted:	false
SSDEEP:	384:1Y+sf5xZhwFtvF6VIpZdoVq3VorSJgX16lUHtFB9F1FqEOUw8xNvtz+7kpU:1Y+sB/+FtvF6kZde1jz+e
MD5:	3A3C0CE18EF40D4E92E7C7EF400F0EE8
SHA1:	A7B1ADF42CA16E93E32D0164D91D91F749CF5634
SHA-256:	063504D6E121A76A6CA07CBDDC067EFB18EA8840028299F85A2D8E2592FE28E6
SHA-512:	6F7D883A74620053431694C42B4A5CB83340FA69760F374D1DFB84F8C4650E455AB3034574CCC12EE34BFF9925CEC612C0289E9FB0E48B9250BFA2811C9E3B00
Malicious:	false
Preview:	MDMP..a..... ........h9f....................................l...`#...........I..........`.......8...........T............I...d...........#...........%..............................................................................eJ......P&......GenuineIntel............T....... ...\|h9f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER461A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	3.7263411812944227
Encrypted:	false
SSDEEP:	192:R6l7wVeJKuD6nYi5JlDRprq89bAnsfkAm:R6lXJH6nYSJlzAsfy
MD5:	6A14978891945B9E38AC53D5780B96EE
SHA1:	2DCDB9B3AE42ACAC20BA24F2708601D1234962AE
SHA-256:	61BF7B38559DD5F584E31F7344B0BA23A363C59A6280FB571C73A1C2013E2A1E
SHA-512:	C9A8545A9119AF1C63531F023D104ADF3098A75DDC4637295468C66C457A5C02EF0A4583F83BC06DF79BC84E3B0E507AF0546D76017F268708CE7FD03167AB27
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER463A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4718
Entropy (8bit):	4.523696716084494
Encrypted:	false
SSDEEP:	48:cvIwWl8zshQJg77aI9rCBWpW8VYmYm8M4JkteF6I+q80v0S5+71lwfd:uIjfsI74Q7VyJ/VA1l+d
MD5:	5CFBE0ADA8596312330D36347D38BFC8
SHA1:	F5C3AEED32ADDD63E4FA0B1A87E8C00AC2EC7BE3
SHA-256:	164763BF3B7E5CACB0CB189AB3E7D8235E6B0CD97DE6985C03953D21127826D7
SHA-512:	0B666C4E159C55B786FC002D513756A672049EE3810FFF8ECC1B47244C0F3AF9CC68A42B05ED76ADBDF6A276599E0A4F1AC98A1676DF647DB79FEAB20B9B4B4C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="311915" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2298896
Entropy (8bit):	7.943949707127546
Encrypted:	false
SSDEEP:	49152:JZZ2yJFMXgNp/R21ABbgdThoxEN2lcHmNNQfwo:JZZF7N1ROABbgdThog24fwo
MD5:	2CF4B5CF327757376E717AB5554B921B
SHA1:	020751E48F382DBD25341228E0ACF66818428B12
SHA-256:	A275C369EF53EBA4655CA43244E230FD7B38E45DBF25FC0B614918A58B3D07A6
SHA-512:	CECCBEAF87660EA08D9BDC5804546C16A2ABEA4F73C8F80345E711CF5C4A8AB9330CA64022B890457187BDE83DE2687177CB50C1A4FC1BF9D49054510E2418FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....96f...............'............X`P...........@...........................h......#...@..................................Q.......p........................h..............................`...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@... .........r..................@..@ X....p...L...D..............@..B.vm_sec..@.......@..................@....idata.......P......................@....tls.........`...........................rsrc........p......................@..@.themida. 5..@......................`....boot....t...`P..t..................`..`.reloc........h.......#.

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\NoSoV6eJxRbhlNXMC2XnYgm.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	7.739784447128016
Encrypted:	false
SSDEEP:	48:9raVXZV//QWGPvcpJVfMR7kl8QbBHy3Rrl735OS1hcj8xNnDyBZVYun3KJ67k0Oj:yZV//Q1vcGQdHA30MNIzYu3KJZ
MD5:	CC7DEAFED3A6A0D17C8B8648F48BBB28
SHA1:	F132D9ADBFC2BD3D5605BCC2E9E5C1B06CA0A800
SHA-256:	6E29C3B738F43B9F11E9ACA40DA25E96C0FB91C23C6370AE0E3BBE9EF5E8D28F
SHA-512:	B930BD3E8E8B96ECAF0A1C30617CDFE0DB25918E1586286FC672A975723ED5B7D42FACD7DBD5F4F8C29B51E1C5DF760E126816BEB41EC661844A9BF56E1CD209
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\NoSoV6eJxRbhlNXMC2XnYgm.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XA.`%............Cookies\Chrome_Default.txt....@.........i.&h.Cn..L...\.FA@.~..v7..O...%!es.f..../S..a...@.,ek.%.H......</<2..,...I..w......1q.f.F+PiM.=h.5..2....0....O..u_.~}Z.UM........y...Rj..4H..D...xLY@....[.d.c&......G_............j%q%....Y.\|.....P...u..u..85/..Z`...-..c...^A8n...Y.3......j.G!....c.....AM@!._W.yQbs.@.....h.y.-......\|J..i...r....c....M...E...GS...C....X..C.U..v.%......C,.L0,......5.=....6.....PK...........Xj.d.....k.......information.txt.Y.R.H.}w..."..b..K.....q7...m..Y.M.W.......J6..M+. B.Je.....4K.$.V.b8.j.*-.1.......Qm..fc.4z&.'....sJ8.r0..47...$4L..G.....9...d>R.26..yB.pp:kt.....B.fq4b.Q..`.Pm...C-.7...Z.T...P.?..\|.X.>Mh8.+..9op^F..L...e.,.......gL....l.pp[..........\|.4Ly..^.G/.8..o.j}_...y.N...<....c....'\|.Q@.<S....I>.'...$....o...hS..4..1...4O..jLv..Q....V.?..I.ZojS..... B. .w._.>.^}.].J.~....9K.u..2U.mZD..t.(...E./7..>:.........e.....,....,Ok..Oi.L..!..Km 2r.6.

C:\Users\user\AppData\Local\Temp\eK26yDxmyAbMrjg7CdmfOmj.zip

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	2860
Entropy (8bit):	7.720862667626285
Encrypted:	false
SSDEEP:	48:9BarXZV//QWGPvcUVwNupS38FlwH5uuErj7qL8V2jm49zieHkzuXYzS3M/dRn3K6:6ZV//Q1vcUOIpSRTUZA99HFIzVT3KJ4
MD5:	7BAAF6EFC43F0561B018A102B243D445
SHA1:	F4061F8E1B37F9954E0A59E17592485CABD22721
SHA-256:	F1C1160A830CE3BDB771D6707C576A3773E82D56E7A13453C3F40776D04E68B7
SHA-512:	8DBE7AA30E74E36DD64C1493DA4DA71FCE6D44CA3C378E2587326E734929654F6D906D7BA74994C37C09CAB7287B2868C70790B8A5BCDCB64E0022656A5805E0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\eK26yDxmyAbMrjg7CdmfOmj.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XA.`%............Cookies\Chrome_Default.txt....@.........i.&h.Cn..L...\.FA@.~..v7..O...%!es.f..../S..a...@.,ek.%.H......</<2..,...I..w......1q.f.F+PiM.=h.5..2....0....O..u_.~}Z.UM........y...Rj..4H..D...xLY@....[.d.c&......G_............j%q%....Y.\|.....P...u..u..85/..Z`...-..c...^A8n...Y.3......j.G!....c.....AM@!._W.yQbs.@.....h.y.-......\|J..i...r....c....M...E...GS...C....X..C.U..v.%......C,.L0,......5.=....6.....PK...........X................information.txt.Y.S.F.........Lk.%....@...qh.}...Q#.\I..N...Nv.9%.a....v....O7i..Q.Ws..}TE..\|.....~.mT.!..(4.....&CF..G.S..G.C....C...\........q2.......<...{?.y....}..@.8.... .I0..Tra.C.....o.d.}AU..Dl.X,..'8.....8'Q.0D....4..\|i`....?Wz}?.....\|%...V.{.....E......_.8..o.j}_...9[N.../.g..Z..d......c.G.AR...g.....Qk...s...b..N6.^.YV.....I.D?.C....F.B......{#.ZoU._.....1....~..\|..a61,5........\g&b...ADh...%.9....&Z...y.w...:./'..Y........R..L.e.W...7..Gd.&.a.o

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:LsXUW:wUW
MD5:	D0A75EBFF72FA9B67AA2874A9CEF49CB
SHA1:	1321F58A68CAAF00627A03FA4E1D2C274B115757
SHA-256:	1D30EA87A95BC86360BD27D6F5399E126E4B2B135AC5BF437AD2FD213CE807B9
SHA-512:	95E55D568E8C4561468BDEEBFA6295701D009796FF0BDF5F949A09499540E3788D3FF697FF256760A069FD7FD4FC5B8E7690CA5921BAB76DD52D8B2E002DA394
Malicious:	false
Preview:	1715044508013

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\8aQjHf7utHnSHistory

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\9V16nhm0bFZXWeb Data

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\EvDoFjSc27w4History

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\FQEh_xU7vRTGWeb Data

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\JEr8lVONTEQKLogin Data

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\LmI4gt7uNt6lWeb Data

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\P8T1BgZgt5t1Cookies

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\RVFvq_w1ZQYbWeb Data

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\dn59MYeqcUJmWeb Data

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\lKkvrLBG06UiLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\nQVbv3R1YjF8Cookies

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\oVix2UaWI8VCHistory

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\q58jgT3UDnoOWeb Data

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\w07ebxHrMjWrHistory

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanlgSFE9XfRUKm\wib805ADjjQsLogin Data

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\1oBLao5WFReeLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\Bs1Rik95T3UPWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\F27iDkUSbUX4History

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\GoTBCXWsNltoCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\IuMVYmRLxIIELogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\KsIfLLPbfavZWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\SrMOR5IqDZZTCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\TQL0dLOETHSsHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\W4StvYRvRm8RLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\djGL4gOVacKhHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\e0WJiscSE76mWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\uH4Klb1syK8iWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\uyAd3P89yfWTHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\vCcKyxUjjGyAWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanuNssG0kGarHs\z81g9YDMLrJHWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixylgSFE9XfRUKm\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	6.005544722730675
Encrypted:	false
SSDEEP:	12:c7F2v4kMx/6UsMbf4/LJPhvkRj6a9kuEYTCRopYxOOVtouEYv:SCJyHXbfQJPh8RdkYiFoYv
MD5:	987FB1A1830B0EB5C0D306F8A2DE9981
SHA1:	8374E6320AD99C3FF177A9889F1AB75448F6EB19
SHA-256:	5EF24A6CE57CA3048431555909EC23CD5494DA76845F84271946442249DDA891
SHA-512:	9E2A48264084B79051FC275DD7780A5552B56220459A1CDDBE6F6A307FE0E5759AE20BC243D085D9734153879AC4E66233AB83F92551DD8092EABF85B16F2D15
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712298002.NID.ENC893_djEwx6CLkXLg8AuSZWCgylmAsMNnd1LSfbcL+IfCgMvX/m5IrzdSwxt6X6n5S6C7wCoUoWvuixZpzrMizGZc5ohIpmsvlOrGTOhFkQ4+lCF6fVH0QNPBBb27o2nXM8em7EAYS1bYZC2LV04SqpgyxJmdfFA7UyWUoK8kFZQDRl0vdOzWdvAoumw2skuCCtJC2oG3z3OYbLTLDbM7wYvVmfDeqtnZRihAAt+ptqI6cfY1a+KO9XP+4XkDSXW7JhsexYHBqzSSBmUisGZ7f9E=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=...google.com.FALSE./.TRUE.1699078840.1P_JAR.ENC893_djEwZKzV9KAslchfQWnVTck71JHMVRC24lvAWgdl5WpYIXlINsbQSVWzkKU=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=..

C:\Users\user\AppData\Local\Temp\trixylgSFE9XfRUKm\information.txt

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6788
Entropy (8bit):	5.454511401811121
Encrypted:	false
SSDEEP:	96:xyONORzSJLcBC1IUlzhge+U8Acf99+KQeTw47OGhLfgAgkM4/DhPigy62/OA61Yg:xYRIL84IUlzhsB
MD5:	06FC6A2B56EABC4E7CDD6DE8AC35FB9F
SHA1:	88FE1D2F77ACBCCA7A7621611721CF6DD22CE3F9
SHA-256:	B0E5B51EE03901CB820B662ADB6337F863E4272A5A06DF904ECE22EA2443BD97
SHA-512:	1087D72E81BDC0017052B73839F034C9935AF7EC8545A9B61EA1927E17DFFABD555B1D2F5BE96D0084A5C2336416A0683C8B90C9FCCC22DA99B15BAB7ED78245
Malicious:	false
Preview:	Build: combo..Version: 2.0....Date: Tue May 7 01:32:17 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 904752e9437da3bfff870d09bb5572b2....Path: C:\Users\user\Desktop\bUHMq54m6Q.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixylgSFE9XfRUKm....IP: 156.146.37.102..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 390120 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 7/5/2024 1:32:17..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fontdrvhost.exe [780]..fontd

C:\Users\user\AppData\Local\Temp\trixylgSFE9XfRUKm\passwords.txt

Download File

Process:	C:\Users\user\Desktop\bUHMq54m6Q.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyuNssG0kGarHs\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	6.005544722730675
Encrypted:	false
SSDEEP:	12:c7F2v4kMx/6UsMbf4/LJPhvkRj6a9kuEYTCRopYxOOVtouEYv:SCJyHXbfQJPh8RdkYiFoYv
MD5:	987FB1A1830B0EB5C0D306F8A2DE9981
SHA1:	8374E6320AD99C3FF177A9889F1AB75448F6EB19
SHA-256:	5EF24A6CE57CA3048431555909EC23CD5494DA76845F84271946442249DDA891
SHA-512:	9E2A48264084B79051FC275DD7780A5552B56220459A1CDDBE6F6A307FE0E5759AE20BC243D085D9734153879AC4E66233AB83F92551DD8092EABF85B16F2D15
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712298002.NID.ENC893_djEwx6CLkXLg8AuSZWCgylmAsMNnd1LSfbcL+IfCgMvX/m5IrzdSwxt6X6n5S6C7wCoUoWvuixZpzrMizGZc5ohIpmsvlOrGTOhFkQ4+lCF6fVH0QNPBBb27o2nXM8em7EAYS1bYZC2LV04SqpgyxJmdfFA7UyWUoK8kFZQDRl0vdOzWdvAoumw2skuCCtJC2oG3z3OYbLTLDbM7wYvVmfDeqtnZRihAAt+ptqI6cfY1a+KO9XP+4XkDSXW7JhsexYHBqzSSBmUisGZ7f9E=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=...google.com.FALSE./.TRUE.1699078840.1P_JAR.ENC893_djEwZKzV9KAslchfQWnVTck71JHMVRC24lvAWgdl5WpYIXlINsbQSVWzkKU=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=..

C:\Users\user\AppData\Local\Temp\trixyuNssG0kGarHs\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6763
Entropy (8bit):	5.453486822202273
Encrypted:	false
SSDEEP:	96:xysBORzSLcBC1IUlzhge+U8Acf99+KQeTw47OGhLfgAgkM4/DhPigy62/OA61YLv:xWRW84IUlzhPB
MD5:	B8958E5F1DE6D63E8AC54C767F4BEF84
SHA1:	C4B15EDB99B71BA90A811636B2CAEC9EAC30EC90
SHA-256:	A07F9B147FBCC63536AFE4F3F3D7294E1BD64105A4EEBEB2663322F5C6882F61
SHA-512:	6BCB2BC14DA4740C943A3EFDF0286183C12A4AE7338281B4EFCCA8DC471C4CA633C0FA9945EB2B7F8E2AFB5EF9FEA032AD11E468C059DE1DD6A0897DABF83365
Malicious:	false
Preview:	Build: combo..Version: 2.0....Date: Tue May 7 01:32:20 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 904752e9437da3bfff870d09bb5572b2....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyuNssG0kGarHs....IP: 156.146.37.102..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 390120 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 7/5/2024 1:32:20..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvho

C:\Users\user\AppData\Local\Temp\trixyuNssG0kGarHs\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.47233161646703
Encrypted:	false
SSDEEP:	6144:kzZfpi6ceLPx9skLmb0fvZWSP3aJG8nAgeiJRMMhA2zX4WABluuNWjDH5S:KZHtvZWOKnMM6bFpMj4
MD5:	7089E7B13B3F7D5480AC10E9FC9BC7BD
SHA1:	B80DCAABFC25F3670FA3EF3D0892CCFB4687B462
SHA-256:	1440607BC822FC949BE90C3A333B2C52EF52E3F0ADFE88A9D28AD0FFC23F5272
SHA-512:	AE6085618880C9A12125CADB435C05F5ACF31739DE941DD330E040C0339730E2E37C61EAD3A41DEE36AED981B3A9078102D4EDF86B4F86A4AD5DE879E7143183
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..O.................................................................................................................................................................................................................................................................................................................................................99X.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943949707127546
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bUHMq54m6Q.exe
File size:	2'298'896 bytes
MD5:	2cf4b5cf327757376e717ab5554b921b
SHA1:	020751e48f382dbd25341228e0acf66818428b12
SHA256:	a275c369ef53eba4655ca43244e230fd7b38e45dbf25fc0b614918a58b3d07a6
SHA512:	ceccbeaf87660ea08d9bdc5804546c16a2abea4f73c8f80345e711cf5c4a8ab9330ca64022b890457187bde83de2687177cb50c1a4fc1bf9d49054510e2418fa
SSDEEP:	49152:JZZ2yJFMXgNp/R21ABbgdThoxEN2lcHmNNQfwo:JZZF7N1ROABbgdThog24fwo
TLSH:	81B533E824E3CFADD275EBF22503911944606F61DFE24BC4B24F696DABE264D437031A
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	1e637808c76c1d83

Static PE Info

General

Entrypoint:	0x906058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x663639CA [Sat May 4 13:36:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63814aaf116ba6abb6496ce4bcad24c6

Entrypoint Preview

Instruction
call 00007FA7CD44E5F0h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FA7CD44E48Ch
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FA7CD44E4F3h
xor eax, eax
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FA7CD44E587h
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007FA7CD44E4AAh
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007FA7CD44E43Bh
mov eax, 00000001h
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FA7CD44E48Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007FA7CD44E4CAh
mov ecx, 00000001h
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007FA7CD44E4A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FA7CD44E48Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a518b	0x184	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a7000	0xc8c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x68e000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1a6018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x18369c	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x15bae8	0x80000	71df898e3bb7791f76e12ed59326dcd2	False	1.000030517578125	data	7.99965539534534	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x15d000	0x27e32	0xc600	d46b2925dda747e309f73efc7cfe5f72	False	0.9986979166666666	data	7.995213678819302	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x185000	0x4930	0x800	3418c8de7b7967df6bb6c2c10ed53efb	False	0.9267578125	data	7.434788372867102	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x18a000	0xc8c0	0x7200	ab55f75c506de7bda0f6900ce3592598	False	0.9992461622807017	interLaced eXtensible Trace (LXT) file (Version 19394)	7.990156009217108	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x197000	0x9858	0x4c00	b115c4aeaf5dbd0a5ed6289fe244caf5	False	0.9952713815789473	OpenPGP Public Key	7.97673825198549	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.vm_sec	0x1a1000	0x4000	0x4000	260e2630b7c17aea8fcc14acc331fbdc	False	0.1627197265625	data	2.8943699511117487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1a5000	0x1000	0x400	c9c064d6bd76a21fe27ddabad4c1bad5	False	0.3994140625	data	3.405869808210115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1a6000	0x1000	0x200	e0820cafed729136bac879e4277031ad	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a7000	0xca00	0xca00	128d0357f9cf8c6ae4deac65154bce26	False	0.6009243502475248	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 4795470227181741839890482462720.000000	5.557009435024348	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x1b4000	0x352000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x506000	0x187400	0x187400	c1e1fc63d9c36264abf090352999e312	False	0.9858744758386582	data	7.954415800190369	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x68e000	0x1000	0x10	9a86cd9aad32621e9b3fc39ac1644b9c	False	1.5	GLS_BINARY_LSB_FIRST	2.474601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a7280	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	Russian	Russia	0.31402439024390244
RT_ICON	0x1a78f8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Russian	Russia	0.42338709677419356
RT_ICON	0x1a7bf0	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	Russian	Russia	0.5061475409836066
RT_ICON	0x1a7de8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Russian	Russia	0.5675675675675675
RT_ICON	0x1a7f20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Russian	Russia	0.46961620469083154
RT_ICON	0x1a8dd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Russian	Russia	0.4020758122743682
RT_ICON	0x1a9690	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Russian	Russia	0.45506912442396313
RT_ICON	0x1a9d68	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Russian	Russia	0.2904624277456647
RT_ICON	0x1aa2e0	0x4b55	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.9921182266009853
RT_ICON	0x1aee48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Russian	Russia	0.316701244813278
RT_ICON	0x1b1400	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.36186679174484054
RT_ICON	0x1b24b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Russian	Russia	0.42418032786885246
RT_ICON	0x1b2e50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5026595744680851
RT_GROUP_ICON	0x1b32c8	0xbc	data	Russian	Russia	0.6170212765957447
RT_VERSION	0x1b3394	0x398	OpenPGP Public Key	Russian	Russia	0.42282608695652174
RT_MANIFEST	0x1b373c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/07/24-01:32:16.104894	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49703	147.45.47.126	192.168.2.6
05/07/24-01:32:30.432420	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49720	147.45.47.126	192.168.2.6
05/07/24-01:32:13.660877	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49699	147.45.47.126	192.168.2.6
05/07/24-01:32:13.858546	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49699	147.45.47.126	192.168.2.6
05/07/24-01:32:16.124524	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49702	147.45.47.126	192.168.2.6
05/07/24-01:32:13.477244	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49699	58709	192.168.2.6	147.45.47.126
05/07/24-01:32:19.524067	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49699	58709	192.168.2.6	147.45.47.126
05/07/24-01:32:39.555621	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49724	147.45.47.126	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 7, 2024 01:32:13.278567076 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:13.469449043 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:13.469577074 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:13.477243900 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:13.660876989 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:13.667802095 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:13.667845964 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:13.783052921 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:13.858546019 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:13.907537937 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:14.020678043 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:14.139029026 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.139059067 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.139132977 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.142656088 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.142673969 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.329277992 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.329396009 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.333462000 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.333468914 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.334161997 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.376305103 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.421844959 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.468121052 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.540182114 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.540312052 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.540374994 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.542649031 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.542665005 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.542674065 CEST	49700	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:14.542680025 CEST	443	49700	34.117.186.192	192.168.2.6
May 7, 2024 01:32:14.632894993 CEST	49701	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:14.632950068 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:14.633013964 CEST	49701	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:14.633465052 CEST	49701	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:14.633486032 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:14.817739010 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:14.817826986 CEST	49701	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:14.820949078 CEST	49701	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:14.820969105 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:14.821257114 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:14.822922945 CEST	49701	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:14.864126921 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:15.073194981 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:15.073291063 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:15.073404074 CEST	49701	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:15.075107098 CEST	49701	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:15.075129032 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:15.075156927 CEST	49701	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:15.075164080 CEST	443	49701	104.26.4.15	192.168.2.6
May 7, 2024 01:32:15.075567961 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.303148031 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.315984011 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.526426077 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.532722950 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.723454952 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.724183083 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.733865023 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.733885050 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.733897924 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.733911037 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.733928919 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.733941078 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.733961105 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.733983040 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.733995914 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.734019995 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.734021902 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.734035015 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.734064102 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.734191895 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.913988113 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.914170027 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.914343119 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.914413929 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.924654007 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.924668074 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.924679041 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.924695015 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.924706936 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.924717903 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:15.924746037 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.924808025 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.930231094 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.931149960 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:15.970340967 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:16.104893923 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:16.124524117 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:16.157565117 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:16.162386894 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:16.165083885 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:16.173194885 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:16.188956976 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:16.347762108 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:16.363729000 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:16.386547089 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:16.391907930 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:16.399765015 CEST	49704	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.399806023 CEST	443	49704	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.399882078 CEST	49704	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.400536060 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.400573969 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.400644064 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.401540041 CEST	49704	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.401550055 CEST	443	49704	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.401700974 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.401714087 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.407533884 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:16.438848019 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:16.470756054 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:16.489178896 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:16.579257011 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.579416990 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.579586983 CEST	443	49704	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.579658031 CEST	49704	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.585294962 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.585305929 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.585603952 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.596322060 CEST	49704	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.596353054 CEST	443	49704	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.596648932 CEST	443	49704	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.626262903 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.641889095 CEST	49704	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.643326044 CEST	49704	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.684127092 CEST	443	49704	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.687324047 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.709248066 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:16.723650932 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:16.732119083 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.791205883 CEST	443	49704	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.791346073 CEST	443	49704	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.791390896 CEST	49704	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.791857958 CEST	49704	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.791876078 CEST	443	49704	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.805900097 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.806020975 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.806159973 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.817986965 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.817986965 CEST	49705	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:16.818008900 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.818020105 CEST	443	49705	34.117.186.192	192.168.2.6
May 7, 2024 01:32:16.905122995 CEST	49706	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:16.905163050 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:16.905235052 CEST	49706	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:16.905622005 CEST	49706	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:16.905633926 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:16.906534910 CEST	49707	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:16.906585932 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:16.906641006 CEST	49707	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:16.906917095 CEST	49707	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:16.906929016 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.084634066 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.084755898 CEST	49706	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.085287094 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.085357904 CEST	49707	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.095485926 CEST	49706	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.095500946 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.095884085 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.106895924 CEST	49707	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.106918097 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.107141972 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.108345032 CEST	49706	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.115477085 CEST	49707	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.152116060 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.160118103 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.341321945 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.341419935 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.341485977 CEST	49707	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.342987061 CEST	49707	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.343020916 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.343038082 CEST	49707	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.343044043 CEST	443	49707	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.343481064 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:17.344883919 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.344975948 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.345046997 CEST	49706	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.349605083 CEST	49706	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.349639893 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.349663019 CEST	49706	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:17.349669933 CEST	443	49706	104.26.4.15	192.168.2.6
May 7, 2024 01:32:17.350029945 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:17.559513092 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:17.572612047 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:17.582211971 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:17.583497047 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:17.776004076 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:17.808643103 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:17.829394102 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:17.860723019 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:17.885466099 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:17.888408899 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.091717005 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.091738939 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.091749907 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.091762066 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.091773987 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.091784954 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.091795921 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.091799021 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.091819048 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.091835976 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.091849089 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.091873884 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.091912031 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.092282057 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.107815027 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107831001 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107842922 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107850075 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107861996 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107891083 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107933044 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107954025 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107966900 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107979059 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.107995987 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.107995987 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.108097076 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.282042980 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.282062054 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.282078028 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.282094002 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.282109976 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.282147884 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.282147884 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.282164097 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.282227993 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.299730062 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.299755096 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.299817085 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.299825907 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.299841881 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.299854994 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.299870014 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.299890041 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.299933910 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.329514980 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.329660892 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.525993109 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.529161930 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.548259020 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.548540115 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.726169109 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.726233006 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.744716883 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.749866009 CEST	58709	49703	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.798141003 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.798151970 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:18.916884899 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:18.916951895 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:19.161294937 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:19.524066925 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:19.755227089 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:20.162344933 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:20.220019102 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:20.412230968 CEST	49703	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:21.688421965 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:21.688461065 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:21.879301071 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:21.879374027 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:21.923219919 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:22.113851070 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:22.114303112 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:22.115963936 CEST	58709	49699	147.45.47.126	192.168.2.6
May 7, 2024 01:32:22.116023064 CEST	49699	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:22.118849039 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:22.173183918 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:24.766993046 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:24.957566023 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:24.959547043 CEST	58709	49702	147.45.47.126	192.168.2.6
May 7, 2024 01:32:24.961766005 CEST	49702	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:30.048589945 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:30.239197969 CEST	58709	49720	147.45.47.126	192.168.2.6
May 7, 2024 01:32:30.241782904 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:30.291966915 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:30.432420015 CEST	58709	49720	147.45.47.126	192.168.2.6
May 7, 2024 01:32:30.482439995 CEST	58709	49720	147.45.47.126	192.168.2.6
May 7, 2024 01:32:30.483721972 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:30.563910961 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:30.674212933 CEST	58709	49720	147.45.47.126	192.168.2.6
May 7, 2024 01:32:30.798213005 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:30.803563118 CEST	58709	49720	147.45.47.126	192.168.2.6
May 7, 2024 01:32:30.896719933 CEST	49722	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:30.896770954 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:30.896895885 CEST	49722	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:30.898324013 CEST	49722	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:30.898345947 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:31.075769901 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:31.075838089 CEST	49722	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:31.077431917 CEST	49722	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:31.077442884 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:31.077708006 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:31.136724949 CEST	49722	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:31.180124044 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:31.281713963 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:31.281841040 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:31.281896114 CEST	49722	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:31.282291889 CEST	49722	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:31.282304049 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:31.282320023 CEST	49722	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:31.282325029 CEST	443	49722	34.117.186.192	192.168.2.6
May 7, 2024 01:32:31.284739017 CEST	49723	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:31.284828901 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.284914017 CEST	49723	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:31.285288095 CEST	49723	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:31.285316944 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.462773085 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.462853909 CEST	49723	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:31.464195013 CEST	49723	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:31.464205027 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.464437962 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.465769053 CEST	49723	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:31.512120962 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.715261936 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.715370893 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.715668917 CEST	49723	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:31.715734959 CEST	49723	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:31.715754032 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.715771914 CEST	49723	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:31.715778112 CEST	443	49723	104.26.4.15	192.168.2.6
May 7, 2024 01:32:31.716088057 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:31.938066959 CEST	58709	49720	147.45.47.126	192.168.2.6
May 7, 2024 01:32:31.938976049 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:32.138453960 CEST	58709	49720	147.45.47.126	192.168.2.6
May 7, 2024 01:32:32.188791037 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:35.175163984 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:35.365742922 CEST	58709	49720	147.45.47.126	192.168.2.6
May 7, 2024 01:32:35.366365910 CEST	58709	49720	147.45.47.126	192.168.2.6
May 7, 2024 01:32:35.366422892 CEST	49720	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:39.170718908 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:39.363013029 CEST	58709	49724	147.45.47.126	192.168.2.6
May 7, 2024 01:32:39.363157988 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:39.382421017 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:39.555620909 CEST	58709	49724	147.45.47.126	192.168.2.6
May 7, 2024 01:32:39.610807896 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:39.615998030 CEST	58709	49724	147.45.47.126	192.168.2.6
May 7, 2024 01:32:39.803148985 CEST	58709	49724	147.45.47.126	192.168.2.6
May 7, 2024 01:32:39.845071077 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:40.079535961 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:40.165095091 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.165143013 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.165254116 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.166342974 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.166359901 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.319169044 CEST	58709	49724	147.45.47.126	192.168.2.6
May 7, 2024 01:32:40.343914032 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.344034910 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.345854044 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.345876932 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.346240044 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.392009020 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.398524046 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.444127083 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.550690889 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.550865889 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.550939083 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.551158905 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.551186085 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.551203966 CEST	49725	443	192.168.2.6	34.117.186.192
May 7, 2024 01:32:40.551209927 CEST	443	49725	34.117.186.192	192.168.2.6
May 7, 2024 01:32:40.552818060 CEST	49726	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:40.552856922 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.552926064 CEST	49726	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:40.553244114 CEST	49726	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:40.553265095 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.733057022 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.733170033 CEST	49726	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:40.734894991 CEST	49726	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:40.734916925 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.735162020 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.736646891 CEST	49726	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:40.784126997 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.996227026 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.996345997 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.996396065 CEST	49726	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:40.996545076 CEST	49726	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:40.996566057 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.996582031 CEST	49726	443	192.168.2.6	104.26.4.15
May 7, 2024 01:32:40.996587992 CEST	443	49726	104.26.4.15	192.168.2.6
May 7, 2024 01:32:40.996956110 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:41.219185114 CEST	58709	49724	147.45.47.126	192.168.2.6
May 7, 2024 01:32:41.220325947 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:41.419053078 CEST	58709	49724	147.45.47.126	192.168.2.6
May 7, 2024 01:32:41.470032930 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:45.572943926 CEST	49724	58709	192.168.2.6	147.45.47.126
May 7, 2024 01:32:45.765316963 CEST	58709	49724	147.45.47.126	192.168.2.6
May 7, 2024 01:32:45.772630930 CEST	58709	49724	147.45.47.126	192.168.2.6
May 7, 2024 01:32:45.772687912 CEST	49724	58709	192.168.2.6	147.45.47.126

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 7, 2024 01:32:14.047110081 CEST	57165	53	192.168.2.6	1.1.1.1
May 7, 2024 01:32:14.132601976 CEST	53	57165	1.1.1.1	192.168.2.6
May 7, 2024 01:32:14.544753075 CEST	55608	53	192.168.2.6	1.1.1.1
May 7, 2024 01:32:14.631848097 CEST	53	55608	1.1.1.1	192.168.2.6
May 7, 2024 01:32:40.073369980 CEST	64982	53	192.168.2.6	1.1.1.1
May 7, 2024 01:32:40.159960032 CEST	53	64982	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 7, 2024 01:32:14.047110081 CEST	192.168.2.6	1.1.1.1	0xee9b	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 7, 2024 01:32:14.544753075 CEST	192.168.2.6	1.1.1.1	0x3800	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 7, 2024 01:32:40.073369980 CEST	192.168.2.6	1.1.1.1	0x7a90	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 7, 2024 01:32:14.132601976 CEST	1.1.1.1	192.168.2.6	0xee9b	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
May 7, 2024 01:32:14.631848097 CEST	1.1.1.1	192.168.2.6	0x3800	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
May 7, 2024 01:32:14.631848097 CEST	1.1.1.1	192.168.2.6	0x3800	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
May 7, 2024 01:32:14.631848097 CEST	1.1.1.1	192.168.2.6	0x3800	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
May 7, 2024 01:32:40.159960032 CEST	1.1.1.1	192.168.2.6	0x7a90	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49700	34.117.186.192	443	6556	C:\Users\user\Desktop\bUHMq54m6Q.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:14 UTC	239	OUT	GET /widget/demo/156.146.37.102 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 23:32:14 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 23:32:14 GMT content-type: application/json; charset=utf-8 Content-Length: 1049 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 23:32:14 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 35 36 2d 31 34 36 2d 33 37 2d 31 30 32 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 Data Ascii: { "input": "156.146.37.102", "data": { "ip": "156.146.37.102", "hostname": "unn-156-146-37-102.cdn77.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS212238 Datacamp
2024-05-06 23:32:14 UTC	308	IN	Data Raw: 22 73 65 72 76 69 63 65 22 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f Data Ascii: "service": "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "netwo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49701	104.26.4.15	443	6556	C:\Users\user\Desktop\bUHMq54m6Q.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:14 UTC	263	OUT	GET /demo/home.php?s=156.146.37.102 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 23:32:15 UTC	658	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 23:32:15 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4672EE:F22E_93878F2E:0050_6639687F_BF05061:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3sg8XUKq2fWJDoYhDgfxHku%2BaIrgTVv6Jnha3ivfmHQKMSCexB7jrkClCi%2FWgcKX4X%2BnXfFeiKmHXiGjiAguyWDoMTI6o8ktBgUB8%2FKPl9%2BUn7jLSmy3nm9J9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87fcc4b9ac053344-EWR alt-svc: h3=":443"; ma=86400
2024-05-06 23:32:15 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 23:32:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49704	34.117.186.192	443	2836	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:16 UTC	239	OUT	GET /widget/demo/156.146.37.102 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 23:32:16 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 23:32:16 GMT content-type: application/json; charset=utf-8 Content-Length: 1049 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 23:32:16 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 35 36 2d 31 34 36 2d 33 37 2d 31 30 32 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 Data Ascii: { "input": "156.146.37.102", "data": { "ip": "156.146.37.102", "hostname": "unn-156-146-37-102.cdn77.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS212238 Datacamp
2024-05-06 23:32:16 UTC	308	IN	Data Raw: 22 73 65 72 76 69 63 65 22 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f Data Ascii: "service": "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "netwo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49705	34.117.186.192	443	4896	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:16 UTC	239	OUT	GET /widget/demo/156.146.37.102 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 23:32:16 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 23:32:16 GMT content-type: application/json; charset=utf-8 Content-Length: 1049 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 23:32:16 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 35 36 2d 31 34 36 2d 33 37 2d 31 30 32 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 Data Ascii: { "input": "156.146.37.102", "data": { "ip": "156.146.37.102", "hostname": "unn-156-146-37-102.cdn77.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS212238 Datacamp
2024-05-06 23:32:16 UTC	308	IN	Data Raw: 22 73 65 72 76 69 63 65 22 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f Data Ascii: "service": "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "netwo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49706	104.26.4.15	443	2836	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:17 UTC	263	OUT	GET /demo/home.php?s=156.146.37.102 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 23:32:17 UTC	656	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 23:32:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9BB6:344C_93878F2E:0050_66396881_BEEBD25:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8xLGRAOATULaeTl%2BOlomlA1GkTbmGWlYW0N7FwDb6NiVQDqb777ROsLlJ8MysLQOoElFi7JC1UuSo46FY6KBphCSTrBvTI1%2BThvTzbafnWyof%2BUBX%2BaMM54pYQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87fcc4c7db7b4381-EWR alt-svc: h3=":443"; ma=86400
2024-05-06 23:32:17 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 23:32:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49707	104.26.4.15	443	4896	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:17 UTC	263	OUT	GET /demo/home.php?s=156.146.37.102 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 23:32:17 UTC	650	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 23:32:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9B6C:3948_93878F2E:0050_66396881_BF05093:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0vmuqs6yH6WK7HVy5SpsE0OaVopBt1ok7QGc0cUpS9f6VG8a0y5uTVXN%2BhvK7zhr4cX0Rhl1dF5YZ6PGACKs2xcqzi8BkU42IuG5O6HgorPx2zXgnSgmiivVsw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87fcc4c7de1f4307-EWR alt-svc: h3=":443"; ma=86400
2024-05-06 23:32:17 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 23:32:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49722	34.117.186.192	443	3604	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:31 UTC	239	OUT	GET /widget/demo/156.146.37.102 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 23:32:31 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 23:32:31 GMT content-type: application/json; charset=utf-8 Content-Length: 1049 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 23:32:31 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 35 36 2d 31 34 36 2d 33 37 2d 31 30 32 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 Data Ascii: { "input": "156.146.37.102", "data": { "ip": "156.146.37.102", "hostname": "unn-156-146-37-102.cdn77.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS212238 Datacamp
2024-05-06 23:32:31 UTC	308	IN	Data Raw: 22 73 65 72 76 69 63 65 22 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f Data Ascii: "service": "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "netwo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49723	104.26.4.15	443	3604	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:31 UTC	263	OUT	GET /demo/home.php?s=156.146.37.102 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 23:32:31 UTC	658	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 23:32:31 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC466E89:96EC_93878F2E:0050_6639688F_BF051B0:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r1xhB03oQXQy%2F208drHqG66uSOHG068g%2BG1zXr14QdOcAcp%2B2XB9fZSMZlVUlB8lfB4BwPxhaqMjFW5fbn2t3VFiRC%2BKE1HOfPKcNtWLYHttp4dB%2FKHjT3i60w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87fcc521b9dac481-EWR alt-svc: h3=":443"; ma=86400
2024-05-06 23:32:31 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 23:32:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49725	34.117.186.192	443	5700	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:40 UTC	239	OUT	GET /widget/demo/156.146.37.102 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-06 23:32:40 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Mon, 06 May 2024 23:32:40 GMT content-type: application/json; charset=utf-8 Content-Length: 1049 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-06 23:32:40 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 35 36 2e 31 34 36 2e 33 37 2e 31 30 32 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 75 6e 6e 2d 31 35 36 2d 31 34 36 2d 33 37 2d 31 30 32 2e 63 64 6e 37 37 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 Data Ascii: { "input": "156.146.37.102", "data": { "ip": "156.146.37.102", "hostname": "unn-156-146-37-102.cdn77.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS212238 Datacamp
2024-05-06 23:32:40 UTC	308	IN	Data Raw: 22 73 65 72 76 69 63 65 22 3a 20 22 43 79 62 65 72 47 68 6f 73 74 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 61 62 75 73 65 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 2c 20 5a 64 65 6e 65 6b 20 43 65 6e 64 72 61 2c 20 32 30 37 20 52 65 67 65 6e 74 20 53 74 72 65 65 74 2c 20 57 31 42 20 33 48 48 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 4e 49 54 45 44 20 4b 49 4e 47 44 4f 4d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 64 61 74 61 63 61 6d 70 2e 63 6f 2e 75 6b 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 43 6f 6e 74 61 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f Data Ascii: "service": "CyberGhost" }, "abuse": { "address": "Datacamp Limited, Zdenek Cendra, 207 Regent Street, W1B 3HH, London, UNITED KINGDOM", "country": "US", "email": "abuse@datacamp.co.uk", "name": "Abuse Contact", "netwo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49726	104.26.4.15	443	5700	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-06 23:32:40 UTC	263	OUT	GET /demo/home.php?s=156.146.37.102 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-06 23:32:40 UTC	656	IN	HTTP/1.1 200 OK Date: Mon, 06 May 2024 23:32:40 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46E6AE:DFDA_93878F2E:0050_66396898_BF052C3:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UecsH8W5bO88a73XJYj0GLZYQJ5cWjEXMLMSIg60rfWsca58GT%2BLfQUj59CwRdLg%2F4AW2KEBSgbbUqOecA%2Bfok0qIctZiatQcrwXuDwSZvL71xwB8X%2BUGwBVYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87fcc55baa4c8c5f-EWR alt-svc: h3=":443"; ma=86400
2024-05-06 23:32:40 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-06 23:32:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:32:10
Start date:	07/05/2024
Path:	C:\Users\user\Desktop\bUHMq54m6Q.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bUHMq54m6Q.exe"
Imagebase:	0x510000
File size:	2'298'896 bytes
MD5 hash:	2CF4B5CF327757376E717AB5554B921B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2159759925.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2276746268.000000000122E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2280792333.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2280715188.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:32:12
Start date:	07/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x1e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:32:12
Start date:	07/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:32:12
Start date:	07/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x1e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:32:12
Start date:	07/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:32:12
Start date:	07/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xf00000
File size:	2'298'896 bytes
MD5 hash:	2CF4B5CF327757376E717AB5554B921B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.2282419782.0000000005A70000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:32:13
Start date:	07/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xf00000
File size:	2'298'896 bytes
MD5 hash:	2CF4B5CF327757376E717AB5554B921B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:32:21
Start date:	07/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 1888
Imagebase:	0x970000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:32:24
Start date:	07/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1148
Imagebase:	0x970000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:32:25
Start date:	07/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x360000
File size:	2'298'896 bytes
MD5 hash:	2CF4B5CF327757376E717AB5554B921B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:32:35
Start date:	07/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x360000
File size:	2'298'896 bytes
MD5 hash:	2CF4B5CF327757376E717AB5554B921B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	46.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	56

Executed Functions

Function 005EFE80 Relevance: 103.7, APIs: 50, Strings: 7, Instructions: 3939registrytimefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 005F008B
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00675B0C,00000001,0000002E,0000002F,?,0066B3BC,3"R,0066B3BC), ref: 005F035B
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005F04D6
FindNextFileA.KERNEL32(00000000,?), ref: 005F04EC
FindClose.KERNEL32(00000000), ref: 005F04FC
GetLastError.KERNEL32 ref: 005F0502
GetLastError.KERNEL32 ref: 005F0520

Part of subcall function 005F7160: GetCurrentProcess.KERNEL32(005F0880), ref: 005F716F
Part of subcall function 005F7160: IsWow64Process.KERNEL32(00000000), ref: 005F7176

Part of subcall function 0055196B: GetSystemTimeAsFileTime.KERNEL32(005F09F8,00000000,00000000,?,?,?,005F09F8,00000000), ref: 00551980
Part of subcall function 0055196B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0055199F

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?,?,?), ref: 005F0CB1
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 005F0D7D
RegCloseKey.ADVAPI32(?), ref: 005F0DB2
GetCurrentHwProfileA.ADVAPI32(?), ref: 005F0F4A
GetModuleHandleExA.KERNEL32(00000004,005F5F40,?,?,?,?,?,?,?,?,00000000), ref: 005F144B
GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,00000000), ref: 005F1463
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 005F1E16
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 005F1EE2
RegCloseKey.ADVAPI32(?), ref: 005F2161
GetComputerNameA.KERNEL32(?,?), ref: 005F2195
GetUserNameA.ADVAPI32(?,?), ref: 005F2333
GetDesktopWindow.USER32 ref: 005F23D6
GetWindowRect.USER32(00000000,?), ref: 005F23E4
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 005F254F
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 005F2A15
LocalAlloc.KERNEL32(00000040), ref: 005F2A27
GetKeyboardLayoutList.USER32(?,00000000), ref: 005F2A42
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 005F2A6D
LocalFree.KERNEL32(?), ref: 005F2C30
GetLocalTime.KERNEL32(?), ref: 005F2C47
GetSystemTime.KERNEL32(?), ref: 005F2E5D
GetTimeZoneInformation.KERNELBASE(?), ref: 005F2E80
TzSpecificLocalTimeToSystemTime.KERNELBASE(?,?,?), ref: 005F2EA5
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 005F32BF
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 005F3411
RegCloseKey.ADVAPI32(?), ref: 005F34C2
GetSystemInfo.KERNELBASE(?), ref: 005F34EA
GlobalMemoryStatusEx.KERNELBASE(?), ref: 005F359D
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 005F36B1
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 005F3A94
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005F3BD3
Process32First.KERNEL32(00000000,?), ref: 005F3BEB
Process32Next.KERNEL32(00000000,?), ref: 005F3C01
Process32Next.KERNEL32(00000000,?), ref: 005F3CD3
CloseHandle.KERNEL32(00000000), ref: 005F3CE2
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 005F4056
RegEnumKeyExA.KERNELBASE(?,00000000,?,?), ref: 005F408D
wsprintfA.USER32 ref: 005F4170
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 005F4193
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 005F4292
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 005F4389
RegCloseKey.ADVAPI32(?), ref: 005F4465
RegCloseKey.ADVAPI32(?), ref: 005F4480

Strings

!z, xrefs: 005F1469
2.0, xrefs: 005F0947, 005F09D8
-Jh, xrefs: 005F1CF0
*S, xrefs: 005F2FE3
*H, xrefs: 005F3CE8
3"R, xrefs: 005EFF46, 005F0610, 005F00F4, 005F00F9, 005F0103
combo, xrefs: 005F08A4, 005F092E

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: CloseTime$FileOpenQueryValue$LocalNameSystem$EnumFindNextProcess32$CreateCurrentDevicesDisplayErrorFirstHandleInfoKeyboardLastLayoutListLocaleModuleProcessUserWindow$AllocComputerCopyDefaultDesktopDirectoryFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: !z$*H$*S$2.0$3"R$combo$-Jh
API String ID: 3185416054-1569301507
Opcode ID: 1d3fcdd70277968fa6b59ec65ad5c0ca8f77a15c5af0ed8b0cfe53010ea40ff9
Instruction ID: 28ce899d3bc24a524407a7e7a14e6afc9743fa974ccf8726b29f9c8aa9c6e659
Opcode Fuzzy Hash: 1d3fcdd70277968fa6b59ec65ad5c0ca8f77a15c5af0ed8b0cfe53010ea40ff9
Instruction Fuzzy Hash: B5B3FFB4D0426DCBDB24CF98D985AEEBBB1BF48300F104199E949BB341D7352A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0051B8E0 Relevance: 79.4, APIs: 40, Strings: 2, Instructions: 5855fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051BA08
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051BAD2
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0051BF80
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0051C47A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051C575
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0051C969
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0051CD72
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0051D17B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051D29A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051D6F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0051D9DC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051DAD7
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0051DE41
CopyFileA.KERNEL32(?,?,00000000), ref: 0051E55A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0051ECF6
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0051EEEA
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051F45B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051F525
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 005201ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00520580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0052088D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00520DC4
CopyFileA.KERNEL32(?,?,00000000), ref: 0052173C
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00521904
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00521CD7
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00521E6E
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00521FBE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00520B14

Part of subcall function 005EFE80: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00675B0C,00000001,0000002E,0000002F,?,0066B3BC,3"R,0066B3BC), ref: 005F035B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00520F12
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051FEF1

Part of subcall function 005F66F0: GetLastError.KERNEL32 ref: 005F6AA0

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051FC55

Part of subcall function 005EFE80: FindFirstFileA.KERNEL32(00000000,?), ref: 005F008B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051F933

Part of subcall function 005F66F0: SetFileAttributesA.KERNEL32(?,00000080,?,?,006994F8,?,?), ref: 005F6A0A
Part of subcall function 005F66F0: DeleteFileA.KERNEL32(?), ref: 005F6A24
Part of subcall function 005F66F0: RemoveDirectoryA.KERNELBASE(?), ref: 005F6A8B
Part of subcall function 005F66F0: std::_Throw_Cpp_error.LIBCPMT ref: 005F6B67
Part of subcall function 005F66F0: std::_Throw_Cpp_error.LIBCPMT ref: 005F6B78

Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CCF
Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CE0

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051E6FA

Part of subcall function 005D5F80: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 005D60BF

Part of subcall function 00539070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0053910D
Part of subcall function 00539070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00539155

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051DF3C

Part of subcall function 005F66F0: FindNextFileA.KERNELBASE(?,00000010), ref: 005F6A38
Part of subcall function 005F66F0: FindClose.KERNEL32(?), ref: 005F6A4A
Part of subcall function 005F66F0: GetLastError.KERNEL32 ref: 005F6A50
Part of subcall function 005F66F0: SetFileAttributesA.KERNELBASE(?,00000080), ref: 005F6A6D

CopyFileA.KERNEL32(?,00000000,00000000), ref: 0051D5FD

Part of subcall function 005F66F0: FindFirstFileA.KERNELBASE(00000000,?,006994F8,?,?,?,\*.*,00000004), ref: 005F6865

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0051BB07

Part of subcall function 005F6C20: GetFileAttributesA.KERNELBASE(?,?,?,00570384), ref: 005F6C7C
Part of subcall function 005F6C20: GetLastError.KERNEL32(?,?,00570384), ref: 005F6C87

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051BD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0051BD37
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051C0CC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051C196

Strings

U[b, xrefs: 0051DB68
1!u, xrefs: 0051C9EC

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Directory$Create$File$Copy$Find$Cpp_errorThrow_std::_$AttributesErrorFirstLast$FolderPath___std_fs_convert_narrow_to_wide@20$CloseDeleteNextRemove
String ID: 1!u$U[b
API String ID: 1172780710-4099298338
Opcode ID: 82367cfca31ea6b53c631d0cfed217821e286d52ea1baf0fd9aa5f3b9a0dc01a
Instruction ID: 86bbdcb160713b5f33e639804443990aff9cadafae674781b75bc42e06f7a356
Opcode Fuzzy Hash: 82367cfca31ea6b53c631d0cfed217821e286d52ea1baf0fd9aa5f3b9a0dc01a
Instruction Fuzzy Hash: FCF3E0B4D0426D8BDF24CFA8D985AEEBBB0BF48304F144199D849B7341DB352A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 005BA180 Relevance: 63.8, APIs: 10, Strings: 15, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 005BA1F7

Part of subcall function 005D5F80: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 005D60BF

Strings

@+'f, xrefs: 005C27A4
cannot use operator[] with a string argument with , xrefs: 005C1475, 005C14AD, 005C1500, 005C1535, 005C156C, 005C3442, 005C3480, 005C3535, 005C8374, 005C840D, 005CDEED, 005CE054, 005CE0A9, 005CE0FE, 005CE159, 005CE1AE, 005CE203, 005CE258, 005CE2AD, 005CE302, 005CFEE5, 005CFF23, 005CFFD8, 005D1D6A, 005D1DA8, 005D1E5D, 005D5E68, 005D5EA0, 005D5F32
@+'f, xrefs: 005C6135
cannot use push_back() with , xrefs: 005C103B, 005C12B3, 005C32E7, 005C34D8, 005C8216, 005C83AE, 005CDF49, 005CDFA0, 005CDFF4, 005CFDA3, 005CFF7B, 005D1C59, 005D1E00, 005D5EDA
[2?, xrefs: 005C26F8
@+'f, xrefs: 005C639D
@+'f, xrefs: 005D486C
\, xrefs: 005CCA4E
[2?, xrefs: 005CCCD6
[2?, xrefs: 005D47C0
@+'f, xrefs: 005CAFCC
1/h, xrefs: 005CC9C0
[2?, xrefs: 005C62EB
U#:, xrefs: 005CAC10
[2?, xrefs: 005CAF32

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: 1/h$@+'f$@+'f$@+'f$@+'f$@+'f$U#:$[2?$[2?$[2?$[2?$[2?$\$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-2428695108
Opcode ID: 9f9f62e26fbceb73e97fcc81e4c459184b8ad970a8f4f3dd661fbb7a2df9c221
Instruction ID: 8a822f5e296ec142d6db216e1baee5612ccea892e712963fd502d14c6713c86f
Opcode Fuzzy Hash: 9f9f62e26fbceb73e97fcc81e4c459184b8ad970a8f4f3dd661fbb7a2df9c221
Instruction Fuzzy Hash: BAB421B4D052698BDB25CF68C984BEEBBB1BF49304F1081D9D849A7281DB356F84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005E7580 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0066B0B2,000000FF), ref: 005E75EC
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 005E7613
CreateDirectoryA.KERNEL32(?,00000000), ref: 005E78D9
CreateDirectoryA.KERNEL32(?,00000000), ref: 005E7C3B
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005E8D77
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005E9912
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EA29E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 005EA36F
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EA692
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EA9FD
CopyFileA.KERNEL32(?,00000000,00000000), ref: 005EAACE
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EADB9
CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 005EB049
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EB1FC
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EB4D6
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EB8BC
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 005EBC71
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EBE24
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EC0FE
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EC4E4
CreateDirectoryA.KERNEL32(?,00000000), ref: 005E9F33

Part of subcall function 005EFE80: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005F04D6
Part of subcall function 005EFE80: GetLastError.KERNEL32 ref: 005F0520

CreateDirectoryA.KERNEL32(?,00000000), ref: 005EC91C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 005ECA73

Part of subcall function 005EE3B0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005EE41D

CreateDirectoryA.KERNEL32(?,00000000), ref: 005E9BD3

Part of subcall function 005F66F0: SetFileAttributesA.KERNEL32(?,00000080,?,?,006994F8,?,?), ref: 005F6A0A
Part of subcall function 005F66F0: DeleteFileA.KERNEL32(?), ref: 005F6A24
Part of subcall function 005F66F0: RemoveDirectoryA.KERNELBASE(?), ref: 005F6A8B
Part of subcall function 005F66F0: std::_Throw_Cpp_error.LIBCPMT ref: 005F6B67
Part of subcall function 005F66F0: std::_Throw_Cpp_error.LIBCPMT ref: 005F6B78

Part of subcall function 005F66F0: GetLastError.KERNEL32 ref: 005F6AA0

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 005E95C8

Part of subcall function 005EFE80: FindNextFileA.KERNEL32(00000000,?), ref: 005F04EC
Part of subcall function 005EFE80: FindClose.KERNEL32(00000000), ref: 005F04FC
Part of subcall function 005EFE80: GetLastError.KERNEL32 ref: 005F0502

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 005E915D

Part of subcall function 005F66F0: FindNextFileA.KERNELBASE(?,00000010), ref: 005F6A38
Part of subcall function 005F66F0: FindClose.KERNEL32(?), ref: 005F6A4A
Part of subcall function 005F66F0: GetLastError.KERNEL32 ref: 005F6A50
Part of subcall function 005F66F0: SetFileAttributesA.KERNELBASE(?,00000080), ref: 005F6A6D

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 005E88EA

Part of subcall function 005EFE80: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00675B0C,00000001,0000002E,0000002F,?,0066B3BC,3"R,0066B3BC), ref: 005F035B

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005E8A9D
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 005E82E2

Part of subcall function 005F66F0: FindFirstFileA.KERNELBASE(00000000,?,006994F8,?,?,?,\*.*,00000004), ref: 005F6865

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 005E85A3
CreateDirectoryA.KERNEL32(?,00000000), ref: 005E7F9B

Part of subcall function 005EFE80: FindFirstFileA.KERNEL32(00000000,?), ref: 005F008B

Part of subcall function 005F6C20: GetFileAttributesA.KERNELBASE(?,?,?,00570384), ref: 005F6C7C
Part of subcall function 005F6C20: GetLastError.KERNEL32(?,?,00570384), ref: 005F6C87

Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CCF
Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CE0

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID:
API String ID: 1140557632-0
Opcode ID: b66d28084eb54c4114aac4df5e9fdecca291e82ad9fbb30df2df6e427740850d
Instruction ID: 53232ecf78f3156b97abda94633deb589b38c0253be042af2a2237cd87034ea5
Opcode Fuzzy Hash: b66d28084eb54c4114aac4df5e9fdecca291e82ad9fbb30df2df6e427740850d
Instruction Fuzzy Hash: D2F303B4D0425A8BDF14CFA8C9956EEBBB0BF48304F144199D949BB341DB316B85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005A03C0 Relevance: 28.0, APIs: 13, Strings: 2, Instructions: 1749registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?), ref: 005A07BB
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 005A07EF
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 005A0815
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 005A09AC
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 005A0C33
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 005A0D20
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 005A0E61
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 005A0F4B
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 005A1035
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 005A111F
RegCloseKey.ADVAPI32(?), ref: 005A221B
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 005A2251
RegCloseKey.ADVAPI32(?), ref: 005A2265

Strings

cannot use operator[] with a string argument with , xrefs: 005A231E, 005A2373
cannot use push_back() with , xrefs: 005A22C5

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2041898428-3306948993
Opcode ID: 617e5659ecb7ee85cdaba202e05522e815e157663e3fdf382791b5c5ab2b9cd3
Instruction ID: 5cf0d9c2ff18ad0a2bdba44ce91c0f7cc233d1b69f5ffcbabc12ae1e597e4b9c
Opcode Fuzzy Hash: 617e5659ecb7ee85cdaba202e05522e815e157663e3fdf382791b5c5ab2b9cd3
Instruction Fuzzy Hash: 6D1311B4D042698BDB25CF28CD84BEEBBB5BF49304F1481D9E549A7241EB716B84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 005A3EC0 Relevance: 26.5, APIs: 12, Strings: 2, Instructions: 1966fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005A3F27

Part of subcall function 005F6C20: GetFileAttributesA.KERNELBASE(?,?,?,00570384), ref: 005F6C7C
Part of subcall function 005F6C20: GetLastError.KERNEL32(?,?,00570384), ref: 005F6C87

FindFirstFileA.KERNEL32(?,?), ref: 005A44DF
FindNextFileA.KERNEL32(00000000,?), ref: 005A48EC
FindClose.KERNEL32(00000000), ref: 005A48FC
CreateDirectoryA.KERNEL32(?,00000000), ref: 005A49D3
CreateDirectoryA.KERNEL32(?,00000000), ref: 005A4A99
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005A4C1D

Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CCF
Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CE0

CreateDirectoryA.KERNEL32(?,00000000), ref: 005A4DC4
CopyFileA.KERNEL32(00000000,?,00000000), ref: 005A5078
CopyFileA.KERNEL32(?,00000000,00000000), ref: 005A55B8
CredEnumerateA.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000004), ref: 005A597D
LocalFree.KERNELBASE(00000000,?,?,?,00000004), ref: 005A6257

Part of subcall function 005451FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,0052ABA8,?,?,?,00541D09,0052ABA8,006899D8,00000000,0052ABA8), ref: 0054525B

Strings

cannot use operator[] with a string argument with , xrefs: 005A6294, 005A62EE
tmi, xrefs: 005A3ECD

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: File$CopyCreateDirectoryFind$Cpp_errorThrow_std::_$AttributesCloseCredEnumerateErrorExceptionFirstFolderFreeLastLocalNextPathRaise
String ID: cannot use operator[] with a string argument with $tmi
API String ID: 3528249430-641046634
Opcode ID: 53e78065d1bdbd521423ed9b0dd19851999650b7282139b2db7fb6ed8963d2f7
Instruction ID: 6500fb483735d15b41969875483fbf23450fc00eeff1fee5b9b3fa4ac95a37fc
Opcode Fuzzy Hash: 53e78065d1bdbd521423ed9b0dd19851999650b7282139b2db7fb6ed8963d2f7
Instruction Fuzzy Hash: CE3310B4D042698BDB25CF68C994BEDBBB0BF49304F1481D9E849A7341EB346B85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005AF050 Relevance: 22.4, APIs: 6, Strings: 5, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005AF1A4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 005AF2A2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 005AF495
CreateDirectoryA.KERNEL32(?,00000000), ref: 005B1BF6

Part of subcall function 005F6C20: GetFileAttributesA.KERNELBASE(?,?,?,00570384), ref: 005F6C7C
Part of subcall function 005F6C20: GetLastError.KERNEL32(?,?,00570384), ref: 005F6C87

CreateDirectoryA.KERNEL32(?,00000000), ref: 005B1EDD
lstrlen.KERNEL32(?), ref: 005B340E

Strings

cannot use operator[] with a string argument with , xrefs: 005B34F1, 005B3546
[2?, xrefs: 005AFAA8
cannot use push_back() with , xrefs: 005B3498
Bbb, xrefs: 005AF996
[2?, xrefs: 005AFC66

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: Bbb$[2?$[2?$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2833034228-788601495
Opcode ID: 8f91d7ab7326f471fa799470452e17fab105313ac1500d9a8df43924fb3f9f77
Instruction ID: 15c3a2c2fc3877a9af2784c0555a1660ee742320774dd97a2f51ac9e8aad35cd
Opcode Fuzzy Hash: 8f91d7ab7326f471fa799470452e17fab105313ac1500d9a8df43924fb3f9f77
Instruction Fuzzy Hash: 6C93DCB4D052A98ADB65CF28C995BEDBBB1BF49304F0081DAD84DA7241DB752BC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00591B90 Relevance: 21.5, APIs: 7, Strings: 4, Instructions: 2202COMMON

Download Yara Rule

APIs

Part of subcall function 005F6C20: GetFileAttributesA.KERNELBASE(?,?,?,00570384), ref: 005F6C7C
Part of subcall function 005F6C20: GetLastError.KERNEL32(?,?,00570384), ref: 005F6C87

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 0059272B
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00592A27
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00592D25
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00593085
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 005933B3
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 005936B7
Concurrency::cancel_current_task.LIBCPMT ref: 00594461

Strings

cannot get value, xrefs: 005943DE, 00594518
type must be boolean, but is , xrefs: 00594487
type must be string, but is , xrefs: 005944DB
cannot compare iterators of different containers, xrefs: 0059441D

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: FolderPath$AttributesConcurrency::cancel_current_taskErrorFileLast
String ID: cannot compare iterators of different containers$cannot get value$type must be boolean, but is $type must be string, but is
API String ID: 1974481932-2698695959
Opcode ID: 927623c3d2501fa3725f80854854fc9ce2b1f3517ca4c3d8409fe929fb581ab3
Instruction ID: 1833c41be1b69e0aca6928825e3d82f3781c3be0c5f147c7e4bc4bd9ea5dd3ab
Opcode Fuzzy Hash: 927623c3d2501fa3725f80854854fc9ce2b1f3517ca4c3d8409fe929fb581ab3
Instruction Fuzzy Hash: EA4312B4D052698BDB25CF24C994BEEBBB5BF49304F1082D9D849A7241EB316F84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005F66F0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,006994F8,?,?,?,\*.*,00000004), ref: 005F6865
SetFileAttributesA.KERNEL32(?,00000080,?,?,006994F8,?,?), ref: 005F6A0A
DeleteFileA.KERNEL32(?), ref: 005F6A24
FindNextFileA.KERNELBASE(?,00000010), ref: 005F6A38
FindClose.KERNEL32(?), ref: 005F6A4A
GetLastError.KERNEL32 ref: 005F6A50
SetFileAttributesA.KERNELBASE(?,00000080), ref: 005F6A6D
RemoveDirectoryA.KERNELBASE(?), ref: 005F6A8B
GetLastError.KERNEL32 ref: 005F6AA0
std::_Throw_Cpp_error.LIBCPMT ref: 005F6B67
std::_Throw_Cpp_error.LIBCPMT ref: 005F6B78

Strings

\*.*, xrefs: 005F67B4

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: 7fbf412907c37470485d75ab03528b7ddeac6dc16c57b958d5c37c65906f909f
Instruction ID: ecf98110e6f3a04af3e4a780f4063b19fcbd69bcf497083fc490238ac95a06b2
Opcode Fuzzy Hash: 7fbf412907c37470485d75ab03528b7ddeac6dc16c57b958d5c37c65906f909f
Instruction Fuzzy Hash: 35D1ED70D01249CFDB20DFA8C9487EEBFB1FF45304F208259E595AB292D7B89A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 005A6330 Relevance: 19.3, APIs: 5, Strings: 5, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005A6484
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 005A6582
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 005A6775
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005A7FF8
lstrlen.KERNEL32(?), ref: 005A84CF

Strings

cannot use operator[] with a string argument with , xrefs: 005A853E, 005A85F0
@+'f, xrefs: 005A759C
cannot use push_back() with , xrefs: 005A838C, 005A858E
[2?, xrefs: 005A7502
`gn+, xrefs: 005A7290

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: @+'f$[2?$`gn+$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-818090161
Opcode ID: b49b436342399e7db39bcdbc7e336b63200faddc90e60b2933b39bf4c2dcaf4e
Instruction ID: 3a0c7fa63f5d628c2555c77d43348f5dc7620c91c7a1f9e63bfe992a21b833ab
Opcode Fuzzy Hash: b49b436342399e7db39bcdbc7e336b63200faddc90e60b2933b39bf4c2dcaf4e
Instruction Fuzzy Hash: A32300B4D052698BDB25CF28C8847EEBBB5BF49304F1482D9E849A7241DB356BC4CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005A8630 Relevance: 17.9, APIs: 4, Strings: 5, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005A8784
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 005A8882
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 005A8A78
lstrlen.KERNEL32(?), ref: 005AAD91

Strings

cannot use operator[] with a string argument with , xrefs: 005AAE03, 005AAE99
[2?, xrefs: 005A96A8
(2?, xrefs: 005A94EA
cannot use push_back() with , xrefs: 005AACB1, 005AAE3A
J6, xrefs: 005A940E

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: (2?$[2?$cannot use operator[] with a string argument with $cannot use push_back() with $J6
API String ID: 1311570089-2412125412
Opcode ID: 685aa518ac49932da1787c577bbaf742446fcafbcb72f4079cd52de5c62493b5
Instruction ID: 1e17cbd684fdd229deedc9769ed6414cbfe6e6e046bfd017235ed45013bf7252
Opcode Fuzzy Hash: 685aa518ac49932da1787c577bbaf742446fcafbcb72f4079cd52de5c62493b5
Instruction Fuzzy Hash: BF4321B0D052698BDB25CF28C8847EEBBB5BF49304F1482D9E449A7242DB756BC4CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005AAEE0 Relevance: 15.9, APIs: 4, Strings: 4, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005AB0D8
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 005AB1E5
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 005AB3D8
lstrlen.KERNEL32(?), ref: 005AD1AD

Strings

cannot use operator[] with a string argument with , xrefs: 005AD21C, 005AD2D3
[2?, xrefs: 005AC008
cannot use push_back() with , xrefs: 005AD06A, 005AD26C
[2?, xrefs: 005ABE4A

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: [2?$[2?$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-2514930191
Opcode ID: 691bf99d01951b5946793e3b41878abc7e8d7c61093600fe20a505af1c5f015f
Instruction ID: 6c2821d31004022642f7b9f86b0ddff0fb258ea1d5c84c3048b7860b209df68b
Opcode Fuzzy Hash: 691bf99d01951b5946793e3b41878abc7e8d7c61093600fe20a505af1c5f015f
Instruction Fuzzy Hash: 5B2311B4D052698BDB25CF28C8947EDBBB5BF49304F1082D9E849A7242DB356F84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005D8510 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 005D853A
getaddrinfo.WS2_32(?,?,?,00699328), ref: 005D85BC
socket.WS2_32(?,?,?), ref: 005D85DD
connect.WS2_32(00000000,00669B1C,?), ref: 005D85F1
closesocket.WS2_32(00000000), ref: 005D85FD
FreeAddrInfoW.WS2_32(?), ref: 005D860A
WSACleanup.WS2_32 ref: 005D8610
FreeAddrInfoW.WS2_32(?), ref: 005D8625

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: 41b86eb365b89d420baee6a46509469ce8cfb8d2f5674d797b9994ab0557e562
Instruction ID: 2af3f46394fd720252eb8fc5986f4226fef6ee05972fe9ba7d430cf54000e088
Opcode Fuzzy Hash: 41b86eb365b89d420baee6a46509469ce8cfb8d2f5674d797b9994ab0557e562
Instruction Fuzzy Hash: D3318571A05700AFD7209F29DC4462ABBE5FB85734F104B1EF965A23E1D770A804CA93

Uniqueness

Uniqueness Score: -1.00%

Function 005AD320 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005AD474
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 005AD572
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 005AD765
lstrlen.KERNEL32(?), ref: 005AEEB2

Strings

cannot use operator[] with a string argument with , xrefs: 005AEF1D, 005AEF5B, 005AF00D
cannot use push_back() with , xrefs: 005AEDF6, 005AEFAB

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: 1b0375717a39bd6d5e457806ce0ee5dacf19cb791f975cc130ab19de1354f0a4
Instruction ID: 02c53e58dd1b7436f3030955af1eea476d35542dd0b1e91dac95b3b4fabe2fd3
Opcode Fuzzy Hash: 1b0375717a39bd6d5e457806ce0ee5dacf19cb791f975cc130ab19de1354f0a4
Instruction Fuzzy Hash: 040345B0D042698BDB25DF28C8857EEBBB5BF49304F1481D9E849A7241EB716F84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005D6D00 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 535
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 005D6FD1

Part of subcall function 00542534: __EH_prolog3.LIBCMT ref: 00542570

std::_Throw_Cpp_error.LIBCPMT ref: 005D6FE2

Part of subcall function 005F7440: __fread_nolock.LIBCMT ref: 005F7589

DeleteFileA.KERNELBASE(?), ref: 005D706B

Strings

131, xrefs: 005D70B5, 005D70CE
combo, xrefs: 005D70F1, 005D710A

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$combo
API String ID: 3880692912-825670192
Opcode ID: 2cfd7e1f50d0439ee3b7b79e184e9705616f30c4b3e3bf4f0c7e6dcdf5921ceb
Instruction ID: 62d8a7f9621a5c59f1c2536c950cfb5097bb3d2f084a9f4de5a6bb5a011e357b
Opcode Fuzzy Hash: 2cfd7e1f50d0439ee3b7b79e184e9705616f30c4b3e3bf4f0c7e6dcdf5921ceb
Instruction Fuzzy Hash: 3B32ACB0D04249DFCF14DFA8D9857EEBBB5BF88304F14415AE8056B382E735AA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0060AC30 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sqlite_rename_table, xrefs: 0060B014
automatic extension loading failed: %s, xrefs: 0060B15C
NOCASE, xrefs: 0060AF5A
RTRIM, xrefs: 0060AE98
no such vfs: %s, xrefs: 0060ADE7
MATCH, xrefs: 0060B038, 0060B049, 0060B069, 0060B06A, 0060B080
BINARY, xrefs: 0060AE55, 0060AE64, 0060AE7E, 0060AEBE, 0060AEC9, 0060AEE1, 0060AF33, 0060AF34

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: ee59143c571d9f4024b7893414dc0de64a849c6ab3320a7e8c52c34734875a49
Instruction ID: 67e89bd8ca6679f4fd0457795d496f32ca3b1a31412bcd36e8aafc08b9735e1a
Opcode Fuzzy Hash: ee59143c571d9f4024b7893414dc0de64a849c6ab3320a7e8c52c34734875a49
Instruction Fuzzy Hash: D6027AB0A807009BEB24DF64DC457AB7BE7EF40344F04852DE84A9B7D1E7B1A985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005EE3B0 Relevance: 8.2, APIs: 5, Instructions: 731
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005EE41D

Part of subcall function 005F6C20: GetFileAttributesA.KERNELBASE(?,?,?,00570384), ref: 005F6C7C
Part of subcall function 005F6C20: GetLastError.KERNEL32(?,?,00570384), ref: 005F6C87

Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CCF
Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CE0

CreateDirectoryA.KERNEL32(?,00000000), ref: 005EE849
CopyFileA.KERNEL32(?,00000000,00000000), ref: 005EEA03
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EEC91
CreateDirectoryA.KERNEL32(?,00000000), ref: 005EEDE7

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID:
API String ID: 1001086254-0
Opcode ID: 72db8909f0a3ed8284b40642fe359b2b355aed16e1c1db3610c2eb3e2b0c25fe
Instruction ID: 849e002974227dec360f2c595c1a60b004219938f78f2f6457551ac22753de1b
Opcode Fuzzy Hash: 72db8909f0a3ed8284b40642fe359b2b355aed16e1c1db3610c2eb3e2b0c25fe
Instruction Fuzzy Hash: 688204B0C0425A8BDF15CFA8D995BEEBBB0BF58304F144199D949BB242E7305A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005D6A80 Relevance: 4.7, APIs: 3, Instructions: 206encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005D6AD7
LocalFree.KERNEL32(?), ref: 005D6B06
LocalFree.KERNEL32(?), ref: 005D6C02

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: bfa01b4b477a761b7520b713380b58c3ced7abdc4cb8245157d66a7cf5cc3f9c
Instruction ID: d6de4f2bfe70806e37089ee048e12a515871b208102c0dea9a6cb539f3e864e1
Opcode Fuzzy Hash: bfa01b4b477a761b7520b713380b58c3ced7abdc4cb8245157d66a7cf5cc3f9c
Instruction Fuzzy Hash: 1871D071C04249ABDB10DFA8C8457EEFFB4FF55310F14826AE850A3391EB786A45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0064F480 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0064F635
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0064F937

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: f8636678fa727509c75bb81e2b7695c98995f72401039149ebadcb934e8d301c
Instruction ID: 652345f2cd81a8fb352e24025b59001c058ff95a6bd135764658715479168be2
Opcode Fuzzy Hash: f8636678fa727509c75bb81e2b7695c98995f72401039149ebadcb934e8d301c
Instruction Fuzzy Hash: 8202CF71604602AFDB58CF28C850BAAB7E6BF88314F04867DE849CB750D774EC95CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0055002D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee47e869768dbd39638bedd3dcef9445f2320fba7adf85636d6437d6e0d28aea
Instruction ID: 453d04050936919637cc73d407184df4d27b4bf4854017083dc6469917f4d58d
Opcode Fuzzy Hash: ee47e869768dbd39638bedd3dcef9445f2320fba7adf85636d6437d6e0d28aea
Instruction Fuzzy Hash: 55B1A574900A0B9BCF248FA8C9796BEBFB1BF44302F142A1BDC52976D1C7359949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 005D7A80 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000374,0000FFFF,00001006,?,00000008), ref: 005D7B26
recv.WS2_32(?,00000004,00000002), ref: 005D7B41
WSAGetLastError.WS2_32 ref: 005D7B45
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 005D7BC3
recv.WS2_32(00000000,0000000C,00000008), ref: 005D7BE4
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 005D7C80
recv.WS2_32(00000000,?,00000008), ref: 005D7C9B

Part of subcall function 005D8510: WSAStartup.WS2_32 ref: 005D853A
Part of subcall function 005D8510: getaddrinfo.WS2_32(?,?,?,00699328), ref: 005D85BC
Part of subcall function 005D8510: socket.WS2_32(?,?,?), ref: 005D85DD
Part of subcall function 005D8510: connect.WS2_32(00000000,00669B1C,?), ref: 005D85F1
Part of subcall function 005D8510: closesocket.WS2_32(00000000), ref: 005D85FD
Part of subcall function 005D8510: FreeAddrInfoW.WS2_32(?), ref: 005D860A
Part of subcall function 005D8510: WSACleanup.WS2_32 ref: 005D8610

recv.WS2_32(?,00000004,00000008), ref: 005D7DA3
__Xtime_get_ticks.LIBCPMT ref: 005D7DAA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005D7DB8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 005D7E31
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 005D7E39

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: 6654191a9f938864bd9543a048d6f628d2593d582557ac4b2fde9f689cf9bd0e
Instruction ID: 4529a3a9882412fcb84fc1514b15d4ee576fd4bcf6dfbbbf642b8ae0914f9cb4
Opcode Fuzzy Hash: 6654191a9f938864bd9543a048d6f628d2593d582557ac4b2fde9f689cf9bd0e
Instruction Fuzzy Hash: 70B18C71D04308DBEB20DFA8CC49BADBFB6BB59304F10425AE414AB6E2E7705984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0056E0C0 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0051B8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 0051BA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0056E1C2
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0056E353
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0056E446
CreateDirectoryA.KERNEL32(?,00000000), ref: 0056E53C
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0056E788
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0056E906
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0056EA9D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0056EB90

Part of subcall function 005F6C20: GetFileAttributesA.KERNELBASE(?,?,?,00570384), ref: 005F6C7C
Part of subcall function 005F6C20: GetLastError.KERNEL32(?,?,00570384), ref: 005F6C87

CreateDirectoryA.KERNEL32(?,00000000), ref: 0056EC86

Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CCF
Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CE0

CreateDirectoryA.KERNEL32(?,00000000), ref: 0056ED6D
CreateDirectoryA.KERNEL32(?,00000000), ref: 0056EFED

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: e10ba393eccaf9f90300857f86b545632de70bd85a7cca79b07b3d3ccc82f8b7
Instruction ID: 987cc667a05b77c5a355e340e3fe7415983b24b888ca7d459ededf205164dd80
Opcode Fuzzy Hash: e10ba393eccaf9f90300857f86b545632de70bd85a7cca79b07b3d3ccc82f8b7
Instruction Fuzzy Hash: 67A220B0D052A98BDB25DB64DC99BDDBBB4BF55300F0040E9E44AA7282EB345F89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005F46A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 005F49F0
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 005F4A5C
LsaOpenPolicy.ADVAPI32(00000000,00697684,00000001,?), ref: 005F4AB5
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 005F4AC8
LsaFreeMemory.ADVAPI32(?), ref: 005F4AF6
LsaClose.ADVAPI32(?), ref: 005F4AFF

Strings

%wZ, xrefs: 005F4AE5

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ
API String ID: 762890658-705104578
Opcode ID: 3c1f3f741268781990df89175224978091475749993d7f59a88df4f537162ef3
Instruction ID: 81237a64dc987a5c7bf4adb04f2124f908add5fe2639c0848997098f5392b416
Opcode Fuzzy Hash: 3c1f3f741268781990df89175224978091475749993d7f59a88df4f537162ef3
Instruction Fuzzy Hash: 7BE1F2B4D0425A9BDB14CF98C986BEEBBB5FF08304F204199EA49B7341D7705A84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00558910 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef4e7d6d23022ec4c0bd4e3701c458dfe323b63ad92a36f2c46e89fbf5aeae1
Instruction ID: 2d5a5efa4d019733597b49920023b2ee80e93cbf42ebeb5d75da04f5938f671a
Opcode Fuzzy Hash: cef4e7d6d23022ec4c0bd4e3701c458dfe323b63ad92a36f2c46e89fbf5aeae1
Instruction Fuzzy Hash: 8BB138B0A04246AFDB01DF98C8A5BBE7FB5BF85312F14055BEC04AB291CB709D49CB64

Uniqueness

Uniqueness Score: -1.00%

Function 005E6B20 Relevance: 9.2, APIs: 6, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 005E6B53
6E837CF0.RSTRTMGR(?,00000000,?), ref: 005E6BD0
SetLastError.KERNEL32(00000000), ref: 005E6C7E
CopyFileA.KERNEL32(?,?,00000000), ref: 005E6CA5
GetLastError.KERNEL32(?,?,00000000), ref: 005E6CB3
CopyFileA.KERNEL32(?,?,00000000), ref: 005E6CC7

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: ErrorLast$CopyFile$E837
String ID:
API String ID: 1618156657-0
Opcode ID: 94872c8a2fe7a52790506553510da64dfbcca8efeae606f1e7505d86dcc8d3fa
Instruction ID: 0ecb7397193c81df33cfa16276874e8ff1e218780e05553ea1c65ccb257a2ad3
Opcode Fuzzy Hash: 94872c8a2fe7a52790506553510da64dfbcca8efeae606f1e7505d86dcc8d3fa
Instruction Fuzzy Hash: 2051CF72D01219ABDB11CFA4DC44BEEBBB9FF49360F10026AE948B7290D7756E05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00519280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 005196A6
GetProcAddress.KERNEL32(00000000,?), ref: 005196B4
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 005196C9

Strings

Ws2_32.dll, xrefs: 0051969A

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: a1df515680ca72104b65961309b7e5207060236a130f4674961564f596a93e52
Instruction ID: e9688f173af97c56434658ff548cc2e6b35165d9ff55cbd080145a3efe56f1d8
Opcode Fuzzy Hash: a1df515680ca72104b65961309b7e5207060236a130f4674961564f596a93e52
Instruction Fuzzy Hash: 3B02BC70D04298DEEF25CFA4C8A07EDBFB0FF55714F244289E4866B286D7741986CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005A3AE0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 264
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 005A3D09
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?), ref: 005A3D2C
RegCloseKey.ADVAPI32(?), ref: 005A3D37

Strings

21o, xrefs: 005A3BB4

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: 21o
API String ID: 3677997916-1934072765
Opcode ID: 85cb9407d3d6d96c1fd092e0460e457e248db2d76f514b7837bb07978aa0f6de
Instruction ID: 637f96a0f2dfdd02f2e00ae3fa22f310c2d971794eb3843587c8e5df3f648557
Opcode Fuzzy Hash: 85cb9407d3d6d96c1fd092e0460e457e248db2d76f514b7837bb07978aa0f6de
Instruction Fuzzy Hash: FDC147B1D0420A9BDB14CFA8C986BEEBBB5FF48314F204159E905B7391D7356A84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005737B0 Relevance: 6.9, APIs: 3, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 005F6C20: GetFileAttributesA.KERNELBASE(?,?,?,00570384), ref: 005F6C7C
Part of subcall function 005F6C20: GetLastError.KERNEL32(?,?,00570384), ref: 005F6C87

Part of subcall function 005F6B90: CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 005F6BD5

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00575C30
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00575F55

Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CCF
Part of subcall function 005F6C20: std::_Throw_Cpp_error.LIBCPMT ref: 005F6CE0

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00575E46

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 6008f6087078a295ea4dbf323955027255635a06f80f0a06bfc73e50a506274b
Instruction ID: a9a6086eb6d4933dfcd5eac5cbdc576e87fd944455c7ebbb3cbcdc1f0f261725
Opcode Fuzzy Hash: 6008f6087078a295ea4dbf323955027255635a06f80f0a06bfc73e50a506274b
Instruction Fuzzy Hash: 7553BCB4D052698BDB65DF14D994BEDBBB4BF89300F0081E9A44EA7291DB342F84DF81

Uniqueness

Uniqueness Score: -1.00%

Function 005F6C20 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,?,00570384), ref: 005F6C7C
GetLastError.KERNEL32(?,?,00570384), ref: 005F6C87
std::_Throw_Cpp_error.LIBCPMT ref: 005F6CCF
std::_Throw_Cpp_error.LIBCPMT ref: 005F6CE0

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 74322d1c2a51bf743665007a425c2ab5c9b4e0877df42998488c169cd3634ada
Instruction ID: 59eeb61d8f005eac00d049d987ad4dd1057c3a3ab025b4274c05fdfaa4c6062e
Opcode Fuzzy Hash: 74322d1c2a51bf743665007a425c2ab5c9b4e0877df42998488c169cd3634ada
Instruction Fuzzy Hash: 02119B7090020996CF245F6CA8197B93F59FB42B24F200319E1F28BAC0CB354C018662

Uniqueness

Uniqueness Score: -1.00%

Function 005E6710 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 005E69A0

Part of subcall function 005E6B20: GetLastError.KERNEL32(?,00000000), ref: 005E6B53
Part of subcall function 005E6B20: 6E837CF0.RSTRTMGR(?,00000000,?), ref: 005E6BD0

std::_Throw_Cpp_error.LIBCPMT ref: 005E6B04
std::_Throw_Cpp_error.LIBCPMT ref: 005E6B15

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyE837ErrorFileLast
String ID:
API String ID: 1216363052-0
Opcode ID: b77c5723c9e12aa8fc19540f1c65474100c057368df91f022a3c53006084b89c
Instruction ID: 8a706682ad7291f0e4087cd3dcbedadb2854d25b146846b2b5fefc58c438e2ac
Opcode Fuzzy Hash: b77c5723c9e12aa8fc19540f1c65474100c057368df91f022a3c53006084b89c
Instruction Fuzzy Hash: CDD19AB0C00249DBDB04CFA8D9457EEBFB1BF55304F248199D445B7282EB755B89CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005F6B90 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 005F6BD5

Part of subcall function 00542BAA: RtlReleaseSRWLockExclusive.NTDLL(005F6CB0), ref: 00542BBE

std::_Throw_Cpp_error.LIBCPMT ref: 005F6C04
std::_Throw_Cpp_error.LIBCPMT ref: 005F6C15

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: e83721b2111301c0dc9bd5bc5d5c7dda343804fba7fdfa502c609e690aa4daa4
Instruction ID: 016421f57e6342e438bdebb394b960c475a68fe1763e3df387711dfd2b62eac6
Opcode Fuzzy Hash: e83721b2111301c0dc9bd5bc5d5c7dda343804fba7fdfa502c609e690aa4daa4
Instruction Fuzzy Hash: D4F021B0900215ABD7109F9CAD0ABAA7BEDE745B24F10032DF8358B7C0E7B10C0186A6

Uniqueness

Uniqueness Score: -1.00%

Function 0055B9D0 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,0054D2B1,?), ref: 0055B9D8
GetLastError.KERNEL32(?,0054D2B1,?), ref: 0055B9E2
__dosmaperr.LIBCMT ref: 0055B9E9

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 117bbeba483036820734d7ab10f45945daf08876440d6d3b84eed13a1ad215e1
Instruction ID: 5af0c4999c8aabc0a90c70f34772a879c63e9a5a3a19ce694f5b00989054f664
Opcode Fuzzy Hash: 117bbeba483036820734d7ab10f45945daf08876440d6d3b84eed13a1ad215e1
Instruction Fuzzy Hash: E1D012326145097B9B006FF6FC0C9167F6DABC13757242612F92CC55A0DF71C8959654

Uniqueness

Uniqueness Score: -1.00%

Function 005F5770 Relevance: 3.4, APIs: 2, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 005F580F
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 005F5B1B

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: 9d20b25aca0b562b4c638eac26170e83a9ccf30069abd37bad681dcb9f07a0f0
Instruction ID: 7f40395c8f036389707ddd57930b37e08562f75d5518941a544fbcb93f93e607
Opcode Fuzzy Hash: 9d20b25aca0b562b4c638eac26170e83a9ccf30069abd37bad681dcb9f07a0f0
Instruction Fuzzy Hash: 8CF144B0D0024A9BDB14CFA8D985BEEFFB1BF48304F244259E545BB341E7756A84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00559789 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00558E9F: GetConsoleOutputCP.KERNEL32(52D829BA,00000000,00000000,0054D0C7), ref: 00558F02

WriteFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,?,005F6DBC,?,0054CFE7,005F6DBC,?,00689E10,00000010,0054D0C7), ref: 0055990E
GetLastError.KERNEL32(?,0054CFE7,005F6DBC,?,00689E10,00000010,0054D0C7,005F6DBC,?,00000000,?), ref: 00559918

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 6b9e2ad9af0d430db79250f61a7068e4444de1a2558a92840956ea2b5709f39b
Instruction ID: 9d573acb762c39e1fece096802f22643ccd4f10b7253226453dd116ffc91a2ab
Opcode Fuzzy Hash: 6b9e2ad9af0d430db79250f61a7068e4444de1a2558a92840956ea2b5709f39b
Instruction Fuzzy Hash: 86618371D0411AEFDF118FA8C854AEEBFB9BF4A305F14054AED04A7256D73AD909CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005E6570 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 005E66EA
std::_Throw_Cpp_error.LIBCPMT ref: 005E66FB

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 26e7919c2219cd9df0e5e5e0ec6b257f03437aa4c2d9061bbba23d2432fd1b35
Instruction ID: 8ce65647308b31bb37e2e55134086b492d3b7062c57dbb84e7bece5ac38ef402
Opcode Fuzzy Hash: 26e7919c2219cd9df0e5e5e0ec6b257f03437aa4c2d9061bbba23d2432fd1b35
Instruction Fuzzy Hash: 214125719102419BCB24DF6CD84136EBBA6BB90350F18032EE855977C1E731DA04CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00558DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00558CE6,00000000,CF830579,0068A178,0000000C,00558DA2,0054D07D,?), ref: 00558E55
GetLastError.KERNEL32(?,00558CE6,00000000,CF830579,0068A178,0000000C,00558DA2,0054D07D,?), ref: 00558E5F

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: ad16ea17232cba6c567406ed8964cec37c0707efd2af2b06bebf4af33d0e385e
Instruction ID: 08827329d45a877a00863b86c7863eae774b62ee0139380a7bf0a360df2b68c0
Opcode Fuzzy Hash: ad16ea17232cba6c567406ed8964cec37c0707efd2af2b06bebf4af33d0e385e
Instruction Fuzzy Hash: 9D116B336041205AC7292B34AC6B77E2F6D7BC2736F28061BFD18AB1D2DF709C898251

Uniqueness

Uniqueness Score: -1.00%

Function 0055251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,0054D0C7,00000000,00000002,00000000,00000000,00000000,00000000,?,00552656,00000000,00000000,0054D0C7,00000002,00000000), ref: 00552558
GetLastError.KERNEL32(00000000,?,00552656,00000000,00000000,0054D0C7,00000002,00000000,?,0055982E,00000000,00000000,00000000,00000002,0054D0C7,00000000), ref: 00552565

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: d8a9c3aa90bb28c7b555802be29151dee89e1e302d6a2e292f86316cc030cfe7
Instruction ID: 34337c62868199ae917531a54ac60d4d13f50c8a82ba12f9ae8867fc2f5c5894
Opcode Fuzzy Hash: d8a9c3aa90bb28c7b555802be29151dee89e1e302d6a2e292f86316cc030cfe7
Instruction Fuzzy Hash: 2001C432610115AFCF098F69DC6599E7F6AFB86321F24020AFC119B2A1F671EA458B90

Uniqueness

Uniqueness Score: -1.00%

Function 0055B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00561B48,?,00000000,?,?,00561DE9,?,00000007,?,?,005622DD,?,?), ref: 0055B030
GetLastError.KERNEL32(?,?,00561B48,?,00000000,?,?,00561DE9,?,00000007,?,?,005622DD,?,?), ref: 0055B03B

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: cb7f847d4cfacb38d04c5b136674218a82e6e602c1c1b30debe263cf635f7ae7
Instruction ID: e6835364e06adb8549f2fb2f711601fb74eedf72ac2e5402708d86e252257af7
Opcode Fuzzy Hash: cb7f847d4cfacb38d04c5b136674218a82e6e602c1c1b30debe263cf635f7ae7
Instruction Fuzzy Hash: 82E08632500604A7DB112FA4EC1CB953F5ABF40752F04802AFB18974F0D7748954C794

Uniqueness

Uniqueness Score: -1.00%

Function 005D7E70 Relevance: 1.9, APIs: 1, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ae3d1b002459f3624128ab5bf0eb385aa24a504f55982e8060207ea67d8849
Instruction ID: c21bf4935ce09ecff83279ec0fd48f9b736b5c371c655b487409418f58b1ecec
Opcode Fuzzy Hash: 46ae3d1b002459f3624128ab5bf0eb385aa24a504f55982e8060207ea67d8849
Instruction Fuzzy Hash: 2202BD70D04248DADF20DFA8C9497EDBFB1BF55304F14419AD8096B382DBB55E88DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00525350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0052546E

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4d5201c289b3c3040b027bd4a197651dc70e2d2533358aeb2ef63f65c24b222e
Instruction ID: 702c6b1fd44f3db0b2e36eb6ce12a6c4d8cbfbd6696458ec93efa817f3073b2a
Opcode Fuzzy Hash: 4d5201c289b3c3040b027bd4a197651dc70e2d2533358aeb2ef63f65c24b222e
Instruction Fuzzy Hash: 1A6186B1A00625DFCB10DF59C984BAAFBF4FF89310F24816AE4199B391D775EA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00533800 Relevance: 1.7, APIs: 1, Instructions: 174COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 005339F6

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0f8dfdcd281579d8485e49bce36b49e61922858251978af35ded1cd305ca0d14
Instruction ID: 43bc68ab6aee992c7334bf453d9e506c1e0520e107e391469ae9848b1e578dca
Opcode Fuzzy Hash: 0f8dfdcd281579d8485e49bce36b49e61922858251978af35ded1cd305ca0d14
Instruction Fuzzy Hash: 0F51B672A001059FCB14DF6CDD86A9DBFA6BB89300F14462EE405E77E5D771EA00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00548E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739e8e26df62ddf78eca7d5901fed8d45cdd2a5412f17f31db73c567b810a6f0
Instruction ID: 13516aa4064addd5dd8b4871e2f5cc79ecbc92ed27581f98d347c1597afe07f1
Opcode Fuzzy Hash: 739e8e26df62ddf78eca7d5901fed8d45cdd2a5412f17f31db73c567b810a6f0
Instruction Fuzzy Hash: 5151B470A00104BFDB14DF58C885AFE7FA6FF89328F248559F8199B252D7719E45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00539E20 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00539F7B

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1df2a4e0321bcc3962d966937d0a8797df2650a6bfd600e0de5b01625875f71d
Instruction ID: 7411e1b32257a9a667c2f337ab4633889a4ba6212b7f0c24c1d0cba3c4fb9e38
Opcode Fuzzy Hash: 1df2a4e0321bcc3962d966937d0a8797df2650a6bfd600e0de5b01625875f71d
Instruction Fuzzy Hash: 4641B1B2E001169FCB14DF68C9459AEBFB9FB89350F24422AE815E7385D7709E018BE0

Uniqueness

Uniqueness Score: -1.00%

Function 005F75C0 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 005F772C

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: e12a3896d419e91a9cf9cdd27e3c117f633fccc464fcb6a6aaf0fcf6022293ad
Instruction ID: 6878476ff8a5410005d3548826e35be009f1cc02d1b4a03145e344e2edafdfe0
Opcode Fuzzy Hash: e12a3896d419e91a9cf9cdd27e3c117f633fccc464fcb6a6aaf0fcf6022293ad
Instruction Fuzzy Hash: 93515AB0D042499BDB20DF98D986BAEFBB4FF48714F10051DE9416B381E7756A44CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 005F7440 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 005F7589

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: d128d083c46abeaddbe8b8fce8b74388853f8170a5075aadd41334301dbe3310
Instruction ID: 68d241be53fb0b52a6533b00008fe5e3fd339b99bbb7de938827d1e2f00b92bb
Opcode Fuzzy Hash: d128d083c46abeaddbe8b8fce8b74388853f8170a5075aadd41334301dbe3310
Instruction Fuzzy Hash: C9415DB1D00209DFDB00DF98D886BEEBBB4FF49714F104159E815AB381E7799A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00516870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00516908

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: 1370f7c0bea0b7a2ba59976b2b0da8fe397391f6ad7d60f70a1129d100700c99
Instruction ID: 033e39f9363dd1ddbc17f34d2a4fdb225e6a0564efe34d9808ebd01752d0609a
Opcode Fuzzy Hash: 1370f7c0bea0b7a2ba59976b2b0da8fe397391f6ad7d60f70a1129d100700c99
Instruction Fuzzy Hash: 1F218F76E00619ABDB14DF48D845BEEBBB4FB84321F00066AEC19A3780DB356D45C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 005F5C80 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(0066D560,00000000,00000000), ref: 005F5CC7

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 5dd6e15f4d092d90458ebdafb03755f43c69e8d6058d29e0469f6d62703f4ea6
Instruction ID: ae2329e3176f0b4e2b39932984703fc64572ea9945d9a1ea15ed1055c59e6749
Opcode Fuzzy Hash: 5dd6e15f4d092d90458ebdafb03755f43c69e8d6058d29e0469f6d62703f4ea6
Instruction Fuzzy Hash: FA11ACB0E04B489BD7208F18D90671ABFE4EB05B24F10471DE951977C1E7BA6A4487D2

Uniqueness

Uniqueness Score: -1.00%

Function 005132D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0051331F

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction ID: 2cc3261da65f61b633e98fe160c119c1012d0b147544b8a280355000225f5499
Opcode Fuzzy Hash: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction Fuzzy Hash: 0DF024321001029BEB146F60D4294E9BBE8FF64361750087AE89CC7222EB26DA80C780

Uniqueness

Uniqueness Score: -1.00%

Function 0055B9F8 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,?,?,?), ref: 0055BA55

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1fd053b72ff6ab698ae4f87165a8864eaf5be5c6e33e29a2a01bf3c1c52e49c4
Instruction ID: e39bd69173761143671bf3982cd6bd6946462362b59a4ac4a45bb3c08949769b
Opcode Fuzzy Hash: 1fd053b72ff6ab698ae4f87165a8864eaf5be5c6e33e29a2a01bf3c1c52e49c4
Instruction Fuzzy Hash: 36F0C8315111126AAB316A65DC3CB6F7F59FFC17B3F140217FC2466090DB30C8489161

Uniqueness

Uniqueness Score: -1.00%

Function 00516840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00516853

Part of subcall function 00541F7B: FindNextFileW.KERNELBASE(?,?,?,00516858,?,?,?,?,0051691A,?,?,?,00000000,?,?), ref: 00541F84

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction ID: 9d1e023d2b2cdbffb6eb057ffb19857b035cb9d1535371ee6209c4e5783cf705
Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction Fuzzy Hash: 42D0C931704922713E25752B39299FF4ED96DD6BB4B45006AB959D3242FF188C8780EA

Uniqueness

Uniqueness Score: -1.00%

Function 005566D5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005566DC

Memory Dump Source

Source File: 00000000.00000002.2272822880.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.2272792458.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2272966412.000000000066D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273006003.0000000000695000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273029672.000000000069A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273063249.00000000006B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273088788.00000000006B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273112638.00000000006B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000006C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000082F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000831000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000833000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000835000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000837000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000868000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000870000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000872000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000874000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.0000000000878000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.000000000087C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2273138885.00000000008AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275588421.0000000000A16000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_bUHMq54m6Q.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 21fd8eb171ae96391994c3f1a4261fe993afb46e28ed9cbd7daabda90b0cb9bd
Instruction ID: be9866072faff7882695877b10b70794d0281351242b44d58c805364d1cd1fc8
Opcode Fuzzy Hash: 21fd8eb171ae96391994c3f1a4261fe993afb46e28ed9cbd7daabda90b0cb9bd
Instruction Fuzzy Hash: 36E075B2C0020EAADB00DFD4C496BEFBBB8AB48314F504066A205E6141EB7897488BA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bUHMq54m6Q.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_5ae7e4c267f7e8254d33e44a3aef75514fc3925e_0010bad0_310ee076-0e1e-4dc2-a821-22b2cb294147\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bUHMq54m6Q.exe_7f5678ff3d44ce164b9187a831663245298324_7fe652d7_b9d6888b-1509-4a56-aeb6-1b74ada72881\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FC2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3215.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3245.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C94.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER461A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER463A.tmp.xml

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\NoSoV6eJxRbhlNXMC2XnYgm.zip

Windows Analysis Report
bUHMq54m6Q.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre