Edit tour

Windows Analysis Report
D44CPdpkNk.exe

Overview

General Information

Sample name:	D44CPdpkNk.exe renamed because original name is a hash value
Original sample name:	093bda46f4ebe927a99cc0e120d50d8c.exe
Analysis ID:	1459954
MD5:	093bda46f4ebe927a99cc0e120d50d8c
SHA1:	1312d8e21c7ac0fcf1f64067690151a86738c856
SHA256:	ffd113a300e84aa5e0f426f711104fb6f6ac411a5c02f620433a0bd76e30b141
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

D44CPdpkNk.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\D44CPdpkNk.exe" MD5: 093BDA46F4EBE927A99CC0E120D50D8C)

schtasks.exe (PID: 7392 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7440 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 7524 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 093BDA46F4EBE927A99CC0E120D50D8C)

WerFault.exe (PID: 4936 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7524 -s 1896 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 280 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 632 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 7500 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 093BDA46F4EBE927A99CC0E120D50D8C)

WerFault.exe (PID: 3244 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1920 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 7600 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 093BDA46F4EBE927A99CC0E120D50D8C)

WerFault.exe (PID: 7792 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 1900 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 7924 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 093BDA46F4EBE927A99CC0E120D50D8C)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\Sfn1YyGgu6CGTeBtRcADBVG.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\UWUWkzI6iEQD6XYchYfKNkl.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\O2ikhRyQ71SvrRUjZ9MvGf7.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\hOyPUaIJ5lfWhg1CogD2H0Y.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2506747814.0000000005660000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000003.2632498657.00000000057A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000002.2667670233.00000000057AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000002.2704555272.0000000005760000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000003.2474706662.00000000057B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2731573576.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000003.2581253200.0000000005621000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000003.2632832669.00000000057A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000003.2478743277.00000000057C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.2733173056.0000000005624000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2632657858.00000000057A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000003.2475226109.00000000057B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2691142764.0000000005660000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: D44CPdpkNk.exe PID: 7344	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: D44CPdpkNk.exe PID: 7344	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7500	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7524	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7600	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7924	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\D44CPdpkNk.exe, ProcessId: 7344, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-10:18:18.266820
SID:	2046269
Source Port:	49732
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-10:18:12.891833
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-10:18:36.172836
SID:	2046269
Source Port:	49747
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-10:17:06.155610
SID:	2049060
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:34.165292
SID:	2046267
Source Port:	58709
Destination Port:	49747
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:10.831103
SID:	2046266
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-10:18:27.329405
SID:	2046269
Source Port:	49734
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:26.653501
SID:	2046266
Source Port:	58709
Destination Port:	49747
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:18.297909
SID:	2046266
Source Port:	58709
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:06.743077
SID:	2046266
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:10.864562
SID:	2046266
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-10:18:18.313506
SID:	2046269
Source Port:	49733
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:23.519101
SID:	2046267
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:23.729447
SID:	2046267
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:23.804516
SID:	2046267
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-10:17:28.105368
SID:	2046267
Source Port:	58709
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://77.91.77.81/mine/amadka.exero	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/mine/amadka.exe	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/go.exe	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/lenin.exein	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exeO	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/mine/amadka.exeA	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exe?~	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/lenin.exeisepro_bot	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exes	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/mine/amadka.exe0.1	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exectrum	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/mine/amadka.exes.binr	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exec176af	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exem	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://77.91.77.81/mine/amadka.exe	Virustotal: Detection: 23%			Perma Link
Source: http://77.91.77.81/cost/go.exe	Virustotal: Detection: 23%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: D44CPdpkNk.exe	ReversingLabs: Detection: 50%
Source: D44CPdpkNk.exe	Virustotal: Detection: 56%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: D44CPdpkNk.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_004C6B00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		5_2_004C6B00

Source: D44CPdpkNk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49751 version: TLS 1.2

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_00493F40
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004938D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	5_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004938D0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49731 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49731 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49733 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49734
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49734 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49747
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49734
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49747 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49747

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 77.91.77.66 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 77.91.77.66:58709

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View

ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Code function: 0_2_004C8590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,FreeAddrInfoW,WSACleanup,FreeAddrInfoW,

0_2_004C8590

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: D44CPdpkNk.exe, 00000000.00000003.2465875391.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2721397992.0000000005787000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2581535637.000000000565C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2581253200.0000000005659000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2733371360.000000000565D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2667457557.000000000577B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe
Source: RageMP131.exe, 00000007.00000003.2581535637.000000000565C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2581253200.0000000005659000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2733371360.000000000565D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe?~
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exeO
Source: RageMP131.exe, 0000000B.00000002.2667457557.000000000577B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exes
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000CD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exec176af
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exectrum
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exein
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exeisepro_bot
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exem
Source: RageMP131.exe, 0000000B.00000002.2667608529.00000000057A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe0.1
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exeA
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exero
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exes.binr
Source: Amcache.hve.17.dr	String found in binary or memory: http://upx.sf.net
Source: D44CPdpkNk.exe, 00000000.00000003.1720099706.0000000002860000.00000004.00001000.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2701725233.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1767157197.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2717586552.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1767470994.0000000002880000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2730516267.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1846027883.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1927997441.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2665087041.000000000055D000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/;8H
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/Kht
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/Q
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33L
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33X
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33dJ6
Source: RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33p3
Source: RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/e8RH(
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33
Source: D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/)
Source: D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D28000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169296486.0000000000D28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/N
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/S
Source: D44CPdpkNk.exe, 00000000.00000003.1720099706.0000000002860000.00000004.00001000.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2701725233.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1767157197.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2717586552.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1767470994.0000000002880000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2730516267.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1846027883.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1927997441.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2665087041.000000000055D000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000CD7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000E90000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33d-
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33o5
Source: D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169296486.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: D44CPdpkNk.exe, 00000000.00000003.2469734911.0000000005660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft.
Source: D44CPdpkNk.exe, 00000000.00000003.2469734911.0000000005660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft..
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://support.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: D44CPdpkNk.exe, 00000000.00000003.2465949048.000000000569A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2464648872.00000000057BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2535985521.0000000005699000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666934296.0000000000F33000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2632992763.0000000000F33000.00000004.00000020.00020000.00000000.sdmp, lsAFEDVzYJlMHistory.6.dr, aSLZ4Feg28S4History.0.dr, v9460BEWAmo6History.6.dr, J7Touhh5YhR_History.0.dr, _1TNl_23bSjIHistory.11.dr, 8cbHFLCQ6whQHistory.7.dr, 5QPDGmo5G4k0History.11.dr, O9ahXmBQyGuqHistory.7.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: lsAFEDVzYJlMHistory.6.dr, aSLZ4Feg28S4History.0.dr, v9460BEWAmo6History.6.dr, J7Touhh5YhR_History.0.dr, _1TNl_23bSjIHistory.11.dr, 8cbHFLCQ6whQHistory.7.dr, 5QPDGmo5G4k0History.11.dr, O9ahXmBQyGuqHistory.7.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: RageMP131.exe, 0000000B.00000002.2666934296.0000000000F33000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2632992763.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016zy
Source: D44CPdpkNk.exe, 00000000.00000003.2465949048.000000000569A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2464648872.00000000057BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2535985521.0000000005699000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, lsAFEDVzYJlMHistory.6.dr, aSLZ4Feg28S4History.0.dr, v9460BEWAmo6History.6.dr, J7Touhh5YhR_History.0.dr, _1TNl_23bSjIHistory.11.dr, 8cbHFLCQ6whQHistory.7.dr, 5QPDGmo5G4k0History.11.dr, O9ahXmBQyGuqHistory.7.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: lsAFEDVzYJlMHistory.6.dr, aSLZ4Feg28S4History.0.dr, v9460BEWAmo6History.6.dr, J7Touhh5YhR_History.0.dr, _1TNl_23bSjIHistory.11.dr, 8cbHFLCQ6whQHistory.7.dr, 5QPDGmo5G4k0History.11.dr, O9ahXmBQyGuqHistory.7.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17oinR6
Source: RageMP131.exe, 00000007.00000002.2733173056.0000000005624000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2632498657.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2667670233.00000000057AA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2632832669.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, Sfn1YyGgu6CGTeBtRcADBVG.zip.7.dr, UWUWkzI6iEQD6XYchYfKNkl.zip.11.dr, hOyPUaIJ5lfWhg1CogD2H0Y.zip.6.dr, O2ikhRyQ71SvrRUjZ9MvGf7.zip.0.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, 00000005.00000003.2478743277.00000000057C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTVgpSODDpgWGzlwXVCLTXRkn.exe
Source: D44CPdpkNk.exe, 00000000.00000003.2506747814.0000000005660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTx&$
Source: D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387635709.0000000000F29000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.7.dr, passwords.txt.0.dr, passwords.txt.11.dr, passwords.txt.6.dr	String found in binary or memory: https://t.me/risepro_bot
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.46.123.33
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot;
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botcAw
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlaterH
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bots
Source: RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.z
Source: D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: D44CPdpkNk.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: D44CPdpkNk.exe, 00000000.00000003.2506747814.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2467560501.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2465674401.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466972371.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2460883690.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2463567446.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2460461316.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2461292656.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466047727.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2464354748.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2469734911.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2463104595.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2459932544.0000000005660000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464250347.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2469251142.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467642669.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2470234298.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2460795598.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2474580731.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2465546710.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464797041.00000000057B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/~
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/~2
Source: 3b6N2Xdh3CYwplaces.sqlite.11.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/7)_1
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/PPORT
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ata
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/
Source: D44CPdpkNk.exe, 00000000.00000003.2506747814.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2467560501.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2465674401.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466972371.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2460883690.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2463567446.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2460461316.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2461292656.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466047727.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2464354748.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2469734911.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2463104595.0000000005660000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2459932544.0000000005660000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464250347.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2469251142.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467642669.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2470234298.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2460795598.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2474580731.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2465546710.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464797041.00000000057B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/r
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ss_1
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/topc
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/xdex

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49751 version: TLS 1.2

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Code function: 0_2_004E5FF0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,735274A0,DeleteObject,DeleteObject,ReleaseDC,

0_2_004E5FF0

System Summary

PE file contains section with special chars

Source: D44CPdpkNk.exe	Static PE information: section name:
Source: D44CPdpkNk.exe	Static PE information: section name:
Source: D44CPdpkNk.exe	Static PE information: section name:
Source: D44CPdpkNk.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0044002D	0_2_0044002D
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004DF030	0_2_004DF030
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0049F0D0	0_2_0049F0D0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004AA200	0_2_004AA200
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0049D3A0	0_2_0049D3A0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004963B0	0_2_004963B0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00490440	0_2_00490440
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004DE430	0_2_004DE430
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0053F550	0_2_0053F550
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004D7600	0_2_004D7600
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004986B0	0_2_004986B0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0040B8E0	0_2_0040B8E0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00481C10	0_2_00481C10
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004FAD00	0_2_004FAD00
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00493F40	0_2_00493F40
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0049AF60	0_2_0049AF60
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004DFF00	0_2_004DFF00
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00493080	0_2_00493080
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004371A0	0_2_004371A0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0044036F	0_2_0044036F
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004A4320	0_2_004A4320
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_005DF4B0	0_2_005DF4B0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004845E0	0_2_004845E0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0042F580	0_2_0042F580
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004A3610	0_2_004A3610
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_005486C0	0_2_005486C0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00547760	0_2_00547760
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004E77E0	0_2_004E77E0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004547BF	0_2_004547BF
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0043C960	0_2_0043C960
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0043A928	0_2_0043A928
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0044DA86	0_2_0044DA86
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00458BB0	0_2_00458BB0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004EEC40	0_2_004EEC40
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004EFC40	0_2_004EFC40
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00534D40	0_2_00534D40
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00546D20	0_2_00546D20
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00545DE0	0_2_00545DE0
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00458E30	0_2_00458E30
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00541F00	0_2_00541F00
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004F2FD0	0_2_004F2FD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044002D	5_2_0044002D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DF030	5_2_004DF030
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0049F0D0	5_2_0049F0D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004AA200	5_2_004AA200
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0049D3A0	5_2_0049D3A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004963B0	5_2_004963B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00490440	5_2_00490440
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DE430	5_2_004DE430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0053F550	5_2_0053F550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004D7600	5_2_004D7600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004986B0	5_2_004986B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0040B8E0	5_2_0040B8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00481C10	5_2_00481C10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004FAD00	5_2_004FAD00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40	5_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0049AF60	5_2_0049AF60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DFF00	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493080	5_2_00493080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004371A0	5_2_004371A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044036F	5_2_0044036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004A4320	5_2_004A4320
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004845E0	5_2_004845E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0042F580	5_2_0042F580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004A3610	5_2_004A3610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005486C0	5_2_005486C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00547760	5_2_00547760
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004E77E0	5_2_004E77E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004547BF	5_2_004547BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043C960	5_2_0043C960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043A928	5_2_0043A928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044DA86	5_2_0044DA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00458BB0	5_2_00458BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004EEC40	5_2_004EEC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004EFC40	5_2_004EFC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00534D40	5_2_00534D40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00546D20	5_2_00546D20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00545DE0	5_2_00545DE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00458E30	5_2_00458E30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00541F00	5_2_00541F00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004F2FD0	5_2_004F2FD0

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: String function: 0041ACE0 appears 86 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0041ACE0 appears 86 times

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 632

Source: D44CPdpkNk.exe	Binary or memory string: OriginalFilename vs D44CPdpkNk.exe
Source: D44CPdpkNk.exe, 00000000.00000000.1717759698.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs D44CPdpkNk.exe
Source: D44CPdpkNk.exe, 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs D44CPdpkNk.exe
Source: D44CPdpkNk.exe	Binary or memory string: OriginalFilenamedotnet.exe6 vs D44CPdpkNk.exe

Source: D44CPdpkNk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: D44CPdpkNk.exe	Static PE information: Section: ZLIB complexity 0.999139195505171
Source: D44CPdpkNk.exe	Static PE information: Section: ZLIB complexity 0.994404957706767
Source: D44CPdpkNk.exe	Static PE information: Section: ZLIB complexity 0.99169921875
Source: D44CPdpkNk.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.999139195505171
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.994404957706767
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99169921875
Source: RageMP131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.999139195505171
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.994404957706767
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99169921875
Source: MPGPH131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@15/106@2/3

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_004DFF00

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7344
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7448:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7600
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7524
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7500

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: D44CPdpkNk.exe, 00000000.00000003.1720099706.0000000002860000.00000004.00001000.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2701725233.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1767157197.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2717586552.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1767470994.0000000002880000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2730516267.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1846027883.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1927997441.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2665087041.000000000055D000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: D44CPdpkNk.exe, 00000000.00000003.1720099706.0000000002860000.00000004.00001000.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2701725233.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1767157197.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2717586552.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1767470994.0000000002880000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2730516267.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1846027883.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1927997441.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2665087041.000000000055D000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: D44CPdpkNk.exe, 00000000.00000003.2460461316.0000000005657000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2461292656.0000000005657000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2462471705.00000000057AA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2460795598.00000000057AA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2462910382.00000000057AB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460044350.0000000005797000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461213005.0000000005797000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2462821569.00000000057A3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2463173746.00000000057B3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461282873.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: D44CPdpkNk.exe	ReversingLabs: Detection: 50%
Source: D44CPdpkNk.exe	Virustotal: Detection: 56%

Source: D44CPdpkNk.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

File read: C:\Users\user\Desktop\D44CPdpkNk.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\D44CPdpkNk.exe "C:\Users\user\Desktop\D44CPdpkNk.exe"
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 632
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7524 -s 1896
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1920
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 1900
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: D44CPdpkNk.exe

Static file information: File size 3285520 > 1048576

Source: D44CPdpkNk.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x26aa00

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_004CF280

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: D44CPdpkNk.exe	Static PE information: section name:
Source: D44CPdpkNk.exe	Static PE information: section name:
Source: D44CPdpkNk.exe	Static PE information: section name:
Source: D44CPdpkNk.exe	Static PE information: section name:
Source: D44CPdpkNk.exe	Static PE information: section name: .themida
Source: D44CPdpkNk.exe	Static PE information: section name: .boot
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .themida
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .themida
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00433F59 push ecx; ret		0_2_00433F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00433F59 push ecx; ret		5_2_00433F6C

Source: D44CPdpkNk.exe	Static PE information: section name: entropy: 7.986055415037788
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.986055415037788
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.986055415037788

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-53652
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-53666
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-53765

Source: C:\Users\user\Desktop\D44CPdpkNk.exe TID: 7348	Thread sleep count: 148 > 30	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe TID: 7488	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe TID: 7348	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7504	Thread sleep count: 113 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7548	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7504	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7528	Thread sleep count: 112 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7544	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7528	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7604	Thread sleep count: 85 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7604	Thread sleep count: 68 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7604	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7928	Thread sleep count: 67 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7928	Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7928	Thread sleep count: 154 > 30

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_00493F40
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004938D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	5_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004938D0

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

0_2_004DFF00

Source: Amcache.hve.17.dr	Binary or memory string: VMware
Source: D44CPdpkNk.exe, 00000000.00000003.1742890450.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}G
Source: D44CPdpkNk.exe, 00000000.00000002.2691142764.0000000005656000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Dk&Ven_VMware&P
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}{x
Source: MPGPH131.exe, 00000005.00000003.2476797753.00000000057BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}C
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}=
Source: Amcache.hve.17.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b},n.pl,o.pl,p.pl,q.pl,r.pl,s.pl,t.pl,u.pl,v.pl,w.pl,x.pl,y.pl,z.pl,a.ar,b.ar,c.ar,d.ar,e.ar,f.ar,g.ar,h.ar,tz
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000E90000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}8
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Pes\o4pultasehissqlAw
Source: RageMP131.exe, 0000000B.00000003.1941752635.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.17.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RageMP131.exe, 00000007.00000002.2733173056.0000000005624000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_63FDBA29og
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_63FDBA29!
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.17.dr	Binary or memory string: vmci.sys
Source: D44CPdpkNk.exe, 00000000.00000003.2473537817.0000000005695000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}*#
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}/7rrP9UK+nYJkDUaruLFsmiax3GAXC2Igj63N1koqBHsy38rIIvg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*B
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&>&
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.17.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.17.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.17.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.17.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.17.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.17.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: RageMP131.exe, 0000000B.00000003.2631426477.00000000057BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_63FDBA29+l
Source: MPGPH131.exe, 00000006.00000002.2719758553.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual USB Mouse
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.17.dr	Binary or memory string: VMware, Inc.
Source: RageMP131.exe, 0000000B.00000002.2666318959.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1hbin@
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&*
Source: Amcache.hve.17.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: RageMP131.exe, 0000000B.00000003.2631426477.00000000057BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_63FDBA29
Source: Amcache.hve.17.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.17.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.17.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.17.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.17.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RageMP131.exe, 0000000B.00000002.2667457557.000000000577B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}es=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsww
Source: Amcache.hve.17.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP"
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWmpN

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00438A64

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

0_2_004CF280

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004C6D80 mov eax, dword ptr fs:[00000030h]	0_2_004C6D80
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00493F40 mov eax, dword ptr fs:[00000030h]	0_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6D80 mov eax, dword ptr fs:[00000030h]	5_2_004C6D80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40 mov eax, dword ptr fs:[00000030h]	5_2_00493F40

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Code function: 0_2_004E9A70 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

0_2_004E9A70

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043451D
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00438A64
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0043451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00438A64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_004CF280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		5_2_004CF280

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: GetLocaleInfoW,	0_2_004531CA
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: EnumSystemLocalesW,	0_2_0044B1B1
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004532F3
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: GetLocaleInfoW,	0_2_004533F9
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004534CF
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: GetLocaleInfoW,	0_2_0044B734
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00452B5A
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: GetLocaleInfoW,	0_2_00452D5F
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: EnumSystemLocalesW,	0_2_00452E51
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: EnumSystemLocalesW,	0_2_00452E06
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: EnumSystemLocalesW,	0_2_00452EEC
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452F77
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_004531CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_0044B1B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_004532F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_004533F9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_004534CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_0044B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00452B5A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_00452D5F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452E51
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452E06
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452EEC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00452F77

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\D44CPdpkNk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.17.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000003.2506747814.0000000005660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2632498657.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2667670233.00000000057AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2704555272.0000000005760000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2474706662.00000000057B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2731573576.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2581253200.0000000005621000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2632832669.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2478743277.00000000057C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2733173056.0000000005624000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2632657858.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2475226109.00000000057B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2691142764.0000000005660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D44CPdpkNk.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7924, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Sfn1YyGgu6CGTeBtRcADBVG.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\UWUWkzI6iEQD6XYchYfKNkl.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\O2ikhRyQ71SvrRUjZ9MvGf7.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\hOyPUaIJ5lfWhg1CogD2H0Y.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: iberty.jaxx
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsonP
Source: MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsns(
Source: MPGPH131.exe, 00000005.00000002.2703864542.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger LiveO

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\D44CPdpkNk.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\D44CPdpkNk.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D44CPdpkNk.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7924, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000003.2506747814.0000000005660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2632498657.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2667670233.00000000057AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2704555272.0000000005760000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2474706662.00000000057B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2731573576.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2581253200.0000000005621000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2632832669.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2478743277.00000000057C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2733173056.0000000005624000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2632657858.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2475226109.00000000057B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2691142764.0000000005660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D44CPdpkNk.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7924, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Sfn1YyGgu6CGTeBtRcADBVG.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\UWUWkzI6iEQD6XYchYfKNkl.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\O2ikhRyQ71SvrRUjZ9MvGf7.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\hOyPUaIJ5lfWhg1CogD2H0Y.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	351 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Virtualization/Sandbox Evasion	Cached Domain Credentials	13 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
D44CPdpkNk.exe	50%	ReversingLabs	Win32.Trojan.RiseProStealer
D44CPdpkNk.exe	56%	Virustotal		Browse
D44CPdpkNk.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	50%	ReversingLabs	Win32.Trojan.RiseProStealer
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	50%	ReversingLabs	Win32.Trojan.RiseProStealer

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ipinfo.io	0%	Virustotal		Browse
db-ip.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://77.91.77.81/mine/amadka.exero	100%	Avira URL Cloud	phishing
http://77.91.77.81/mine/amadka.exe	100%	Avira URL Cloud	malware
https://ipinfo.io:443/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exe	23%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exe	100%	Avira URL Cloud	malware
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://77.91.77.81/cost/lenin.exein	100%	Avira URL Cloud	phishing
https://db-ip.com/	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33d-	0%	Avira URL Cloud	safe
https://t.p	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTVgpSODDpgWGzlwXVCLTXRkn.exe	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exe	23%	Virustotal		Browse
https://db-ip.com/demo/home.php?s=8.46.123.33X	0%	Avira URL Cloud	safe
https://db-ip.com/	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33L	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016zy	0%	Avira URL Cloud	safe
https://t.me/risepro	0%	Avira URL Cloud	safe
https://t.z	0%	Avira URL Cloud	safe
https://db-ip.com/e8RH(	0%	Avira URL Cloud	safe
https://support.microsoft..	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://t.me/risepro	0%	Virustotal		Browse
http://77.91.77.81/cost/go.exeO	100%	Avira URL Cloud	phishing
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	Avira URL Cloud	safe
https://support.microsoft..	0%	Virustotal		Browse
https://db-ip.com:443/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33o5	0%	Avira URL Cloud	safe
https://t.me/risepro_botisepro_bot	0%	Avira URL Cloud	safe
https://t.me/risepro_bot;	0%	Avira URL Cloud	safe
https://db-ip.com/Q	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exeA	100%	Avira URL Cloud	phishing
http://77.91.77.81/cost/go.exe?~	100%	Avira URL Cloud	malware
https://db-ip.com/;8H	0%	Avira URL Cloud	safe
https://t.me/risepro_bot.46.123.33	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17oinR6	0%	Avira URL Cloud	safe
https://t.me/risepro_botisepro_bot	0%	Virustotal		Browse
https://t.me/risepro_bot;	0%	Virustotal		Browse
https://db-ip.com/demo/home.php?s=8.46.123.33dJ6	0%	Avira URL Cloud	safe
https://t.me/risepro_botlaterH	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://support.microsoft.	0%	Avira URL Cloud	safe
https://db-ip.com/Q	0%	Virustotal		Browse
http://77.91.77.81/cost/lenin.exeisepro_bot	100%	Avira URL Cloud	phishing
https://db-ip.com/Kht	0%	Avira URL Cloud	safe
https://ipinfo.io/S	0%	Avira URL Cloud	safe
https://support.microsoft.	0%	Virustotal		Browse
http://77.91.77.81/cost/go.exes	100%	Avira URL Cloud	phishing
https://t.me/risepro_botlaterH	0%	Virustotal		Browse
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	Avira URL Cloud	safe
https://ipinfo.io/N	0%	Avira URL Cloud	safe
https://ipinfo.io/Mozilla/5.0	0%	Avira URL Cloud	safe
https://t.me/risepro_bot	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTx&$	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exe0.1	100%	Avira URL Cloud	phishing
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://t.me/risepro_botcAw	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
https://ipinfo.io/)	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exectrum	100%	Avira URL Cloud	phishing
http://77.91.77.81/mine/amadka.exes.binr	100%	Avira URL Cloud	phishing
https://support.mozilla.org	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exec176af	100%	Avira URL Cloud	phishing
http://77.91.77.81/cost/lenin.exem	100%	Avira URL Cloud	phishing
https://db-ip.com/demo/home.php?s=8.46.123.33p3	0%	Avira URL Cloud	safe
https://t.me/risepro_bots	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false	0%, Virustotal, Browse	unknown
db-ip.com	104.26.4.15	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/8.46.123.33	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.91.77.81/mine/amadka.exe	RageMP131.exe, 0000000B.00000002.2667608529.00000000057A1000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://77.91.77.81/mine/amadka.exero	MPGPH131.exe, 00000005.00000002.2703127000.0000000000C57000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/chrome_newtab	D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169296486.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	3b6N2Xdh3CYwplaces.sqlite.11.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exe	D44CPdpkNk.exe, 00000000.00000003.2465875391.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2721397992.0000000005787000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2581535637.000000000565C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2581253200.0000000005659000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2733371360.000000000565D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2667457557.000000000577B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://77.91.77.81/cost/lenin.exein	MPGPH131.exe, 00000006.00000002.2719758553.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://db-ip.com/	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33d-	RageMP131.exe, 0000000B.00000002.2666318959.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.p	RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTVgpSODDpgWGzlwXVCLTXRkn.exe	MPGPH131.exe, 00000005.00000003.2478743277.00000000057C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	false	URL Reputation: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33X	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	D44CPdpkNk.exe, 00000000.00000003.2465949048.000000000569A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2464648872.00000000057BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2535985521.0000000005699000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, lsAFEDVzYJlMHistory.6.dr, aSLZ4Feg28S4History.0.dr, v9460BEWAmo6History.6.dr, J7Touhh5YhR_History.0.dr, _1TNl_23bSjIHistory.11.dr, 8cbHFLCQ6whQHistory.7.dr, 5QPDGmo5G4k0History.11.dr, O9ahXmBQyGuqHistory.7.dr	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33L	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016zy	RageMP131.exe, 0000000B.00000002.2666934296.0000000000F33000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2632992763.0000000000F33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.z	MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro	D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.microsoft..	D44CPdpkNk.exe, 00000000.00000003.2469734911.0000000005660000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://db-ip.com/e8RH(	RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exeO	MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	lsAFEDVzYJlMHistory.6.dr, aSLZ4Feg28S4History.0.dr, v9460BEWAmo6History.6.dr, J7Touhh5YhR_History.0.dr, _1TNl_23bSjIHistory.11.dr, 8cbHFLCQ6whQHistory.7.dr, 5QPDGmo5G4k0History.11.dr, O9ahXmBQyGuqHistory.7.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33o5	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botisepro_bot	MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/risepro_bot;	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.81/mine/amadka.exeA	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://db-ip.com/Q	RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exe?~	RageMP131.exe, 00000007.00000003.2581535637.000000000565C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2581253200.0000000005659000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2733371360.000000000565D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://db-ip.com/;8H	RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot.46.123.33	RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17oinR6	RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33dJ6	RageMP131.exe, 00000007.00000002.2731573576.0000000000D43000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botlaterH	RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.microsoft.	D44CPdpkNk.exe, 00000000.00000003.2469734911.0000000005660000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exeisepro_bot	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://db-ip.com/Kht	MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/S	MPGPH131.exe, 00000006.00000002.2719758553.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exes	RageMP131.exe, 0000000B.00000002.2667457557.000000000577B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	D44CPdpkNk.exe, 00000000.00000003.1720099706.0000000002860000.00000004.00001000.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2701725233.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1767157197.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2717586552.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1767470994.0000000002880000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2730516267.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1846027883.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1927997441.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2665087041.000000000055D000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.17.dr	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	RageMP131.exe, 00000007.00000002.2733173056.0000000005624000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2632498657.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2667670233.00000000057AA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2632832669.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, Sfn1YyGgu6CGTeBtRcADBVG.zip.7.dr, UWUWkzI6iEQD6XYchYfKNkl.zip.11.dr, hOyPUaIJ5lfWhg1CogD2H0Y.zip.6.dr, O2ikhRyQ71SvrRUjZ9MvGf7.zip.0.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	D44CPdpkNk.exe, 00000000.00000003.2465949048.000000000569A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2464648872.00000000057BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2535985521.0000000005699000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666934296.0000000000F33000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2632992763.0000000000F33000.00000004.00000020.00020000.00000000.sdmp, lsAFEDVzYJlMHistory.6.dr, aSLZ4Feg28S4History.0.dr, v9460BEWAmo6History.6.dr, J7Touhh5YhR_History.0.dr, _1TNl_23bSjIHistory.11.dr, 8cbHFLCQ6whQHistory.7.dr, 5QPDGmo5G4k0History.11.dr, O9ahXmBQyGuqHistory.7.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/N	RageMP131.exe, 00000007.00000002.2731573576.0000000000D28000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169296486.0000000000D28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/Mozilla/5.0	D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2169164175.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2731573576.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387506788.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	3b6N2Xdh3CYwplaces.sqlite.11.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	false	URL Reputation: safe	unknown
https://t.me/risepro_bot	RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2387635709.0000000000F29000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.7.dr, passwords.txt.0.dr, passwords.txt.11.dr, passwords.txt.6.dr	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTx&$	D44CPdpkNk.exe, 00000000.00000003.2506747814.0000000005660000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/mine/amadka.exe0.1	MPGPH131.exe, 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.maxmind.com/en/locate-my-ip-address	D44CPdpkNk.exe, MPGPH131.exe	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botcAw	MPGPH131.exe, 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	D44CPdpkNk.exe, 00000000.00000003.1720099706.0000000002860000.00000004.00001000.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.2701725233.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1767157197.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2717586552.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1767470994.0000000002880000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.2730516267.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000007.00000003.1846027883.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.1927997441.0000000000DA0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2665087041.000000000055D000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/)	MPGPH131.exe, 00000005.00000002.2703127000.0000000000CA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exectrum	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://77.91.77.81/mine/amadka.exes.binr	MPGPH131.exe, 00000006.00000002.2719758553.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.mozilla.org	3b6N2Xdh3CYwplaces.sqlite.11.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	lsAFEDVzYJlMHistory.6.dr, aSLZ4Feg28S4History.0.dr, v9460BEWAmo6History.6.dr, J7Touhh5YhR_History.0.dr, _1TNl_23bSjIHistory.11.dr, 8cbHFLCQ6whQHistory.7.dr, 5QPDGmo5G4k0History.11.dr, O9ahXmBQyGuqHistory.7.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exec176af	MPGPH131.exe, 00000006.00000002.2719758553.0000000000CD7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://77.91.77.81/cost/lenin.exem	RageMP131.exe, 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33p3	RageMP131.exe, 0000000B.00000003.2387506788.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bots	D44CPdpkNk.exe, 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2076042690.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	D44CPdpkNk.exe, 00000000.00000003.2462949812.000000000569A000.00000004.00000020.00020000.00000000.sdmp, D44CPdpkNk.exe, 00000000.00000003.2466769777.00000000056AC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2464115255.00000000057DE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.2467965125.00000000057FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2461510506.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2465499374.00000000057DC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2460474928.00000000057AE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2536129410.000000000568C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2537025525.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.2541983157.00000000056BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2627048906.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000B.00000003.2623929888.00000000057D2000.00000004.00000020.00020000.00000000.sdmp, u1bz9SOgrSepWeb Data.7.dr, 8K3NvYKoF0DKWeb Data.0.dr, CW09Q1VnvrXtWeb Data.6.dr, X4w8fLfloerdWeb Data.11.dr, TGgMbIm7Fwe7Web Data.6.dr, owf9GshuzJ25Web Data.11.dr, qZ4vtdSQrsMXWeb Data.11.dr, t1K7aC5iYP_kWeb Data.7.dr, JiGBQplW34HlWeb Data.0.dr	false	URL Reputation: safe	unknown
http://77.91.77.81/cost/lenin.exe	RageMP131.exe, 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
77.91.77.66	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1459954
Start date and time:	2024-06-20 10:16:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	D44CPdpkNk.exe renamed because original name is a hash value
Original Sample Name:	093bda46f4ebe927a99cc0e120d50d8c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@15/106@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 67% Number of executed functions: 50 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:18:39	API Interceptor	4x Sleep call for process: WerFault.exe modified
09:17:06	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
09:17:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
09:17:07	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
09:17:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName
77.91.77.66	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://telegliam.icu/	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://ingresar-365-msn.glitch.me/	Get hash	malicious	Unknown	Browse	34.117.186.192
	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	win6.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse	34.117.186.192
	4Ip0IVHqJ3.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
db-ip.com	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	104.26.4.15
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	https://curious-kringle-id4964-024b3b3.netlify.app/form.html	Get hash	malicious	Unknown	Browse	104.26.5.15
	https://glist43-dase23-ac9ae33.netlify.app/dev.html/	Get hash	malicious	Unknown	Browse	104.26.5.15
	4Ip0IVHqJ3.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	eIbDy5M3wa.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	2022and2023TaxDocuments.zip	Get hash	malicious	Remcos	Browse	77.91.77.107
	https://securityzones.blob.core.windows.net/app/qb.html?k0q2g%5Cu0026sa%5Cu003dD%5Cu0026source%5Cu003dapps-viewer-frontend%5Cu0026ust%5Cu003d1718848253213951%5Cu0026usg%5Cu003dAOvVaw07eeibWUO-ccHOx9vz-o	Get hash	malicious	Unknown	Browse	77.91.77.5
	AgHiy5gaGp.exe	Get hash	malicious	Amadey, PureLog Stealer	Browse	77.91.77.80
	http://u.to/Tr_9IA	Get hash	malicious	Unknown	Browse	77.91.66.92
	https://drive.google.com/file/d/1JwMEh9AmJIvZiNdqJh4RUnTkYVtbznuJ/view?ts=666b8066	Get hash	malicious	Unknown	Browse	77.91.77.5
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://h3200457.wixsite.com/my-site-1/	Get hash	malicious	Unknown	Browse	34.117.60.144
	http://telegliam.icu/	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://riprogramma.consegna.3-76-125-238.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	34.117.77.79
	http://3-76-125-238.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://ingresar-365-msn.glitch.me/	Get hash	malicious	Unknown	Browse	34.117.186.192
	http://underarmour.ca	Get hash	malicious	Unknown	Browse	34.117.202.77
CLOUDFLARENETUS	http://tinyurI.com/bn229tan	Get hash	malicious	Unknown	Browse	172.64.151.101
	IMPS_transaction_error_details_account-900192_xls.js	Get hash	malicious	WSHRAT	Browse	188.114.96.3
	IMPS_transaction_error_details_account-900192_xls.js	Get hash	malicious	Unknown	Browse	172.67.154.165
	https://cssa.evlink2.net/servlet/link/855/184352/1637605/1648475	Get hash	malicious	Unknown	Browse	104.18.21.157
	NEW ORDER.docx.doc	Get hash	malicious	Unknown	Browse	104.21.83.128
	Purchase Order 0030520574.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	NEW ORDER.docx.doc	Get hash	malicious	Unknown	Browse	104.21.83.128
	https://whateveryourdose.com	Get hash	malicious	Unknown	Browse	104.26.4.143
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	NEW ORDER.docx.doc	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192 104.26.4.15
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	RobloxPlayerInstaller.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	http://voice-100740.weeblysite.com/	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	fortnitewhv5.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	DyEmdWLfg4.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	f5tZjE2iHW.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3285520
Entropy (8bit):	7.9670682991434125
Encrypted:	false
SSDEEP:	49152:YQqdyW2QvYnYuHn2XYMGpokbLH+WYbIloN32VjGFbNNv9sCLBfqKtt/LBs3r7G8b:YQCyrmYnYiLlPbL2MVQYCVXLOaxc
MD5:	093BDA46F4EBE927A99CC0E120D50D8C
SHA1:	1312D8E21C7AC0FCF1F64067690151A86738C856
SHA-256:	FFD113A300E84AA5E0F426F711104FB6F6AC411A5C02F620433A0BD76E30B141
SHA-512:	83C2E93B5DDCA444391AFCB7229EC2EE2ED40F1637C05C4984F907D00643D8023B7EC344AE17410114CB123FB05A8F693866349318AFB3844C39FEBABE06A475
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X.X...........@...........................~.......2......................................a..........8.....................~..............................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..>..........x..............`....boot.....&...X...&..x..............`..`.reloc........~......"2................@................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_D44CPdpkNk.exe_ca452f225a5bfbfa4899462b03597b9e382c87a_da5453f1_eb289314-d05a-4b54-8b62-645a63860303\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0506085940821464
Encrypted:	false
SSDEEP:	192:5eOCizT+0kYqtEjyZrosLZuzuiFUZ24IO81:RCizTlkYqKjyuzuiFUY4IO81
MD5:	E911ED2344EBC5AA8AB3BC6CF3211250
SHA1:	9DE3C62D2B474D015928EEC77B5F1C5688FEAB88
SHA-256:	DCE8FAFAE058461429075260EB4177706C7C4F98DE937273F1EC8EB4D7F05B99
SHA-512:	731BC8CFBB345D29E713DE9C35B9DCA0AEA798DFD5AC5F600ED19A1F586A305BF5DC528A46B7B292F696A2D3B54B52EB7A9A3687CE062D38FDCB756D688AB80D
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.4.5.1.0.2.3.0.9.2.7.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.4.5.1.0.5.1.5.2.9.6.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.b.2.8.9.3.1.4.-.d.0.5.a.-.4.b.5.4.-.8.b.6.2.-.6.4.5.a.6.3.8.6.0.3.0.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.3.9.6.b.2.5.7.-.2.7.d.6.-.4.e.4.0.-.8.f.2.5.-.c.d.c.2.e.e.9.2.e.2.0.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.D.4.4.C.P.d.p.k.N.k...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.b.0.-.0.0.0.1.-.0.0.1.4.-.6.2.1.b.-.c.e.3.a.e.a.c.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.1.3.1.2.d.8.e.2.1.c.7.a.c.0.f.c.f.1.f.6.4.0.6.7.6.9.0.1.5.1.a.8.6.7.3.8.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_2699415f5fdb1b8726d39a1517f1ac2e93897fae_f4fd270f_91cbe5a9-858b-41b9-933d-561fbdab6283\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0492858128431617
Encrypted:	false
SSDEEP:	192:8NzlUaizN8Sm0M8rr6E6jjyZrofxjPzuiFUZ24IO8q6t:yp32N/NM8rCjrPzuiFUY4IO81
MD5:	D247D20603556694B71F4367A68B272D
SHA1:	9421AB2B219DB3F93BCBBD4B7FAA2F1B5625A1F8
SHA-256:	E40011E4C5794EEA41350075BEF58C156DED567E19FD70924C0875D5599D826C
SHA-512:	F026CC85387EFD9A695E9B90B37082FF6BCF0FB08A77917B547B4F722504115B4D631E17E219C474D02886FF017E29ECF2F8DF8CF2F8BFCA4E6F25FB29C75EBC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.4.5.1.0.2.7.8.8.1.1.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.4.5.1.0.5.2.8.8.1.1.3.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.c.b.e.5.a.9.-.8.5.8.b.-.4.1.b.9.-.9.3.3.d.-.5.6.1.f.b.d.a.b.6.2.8.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.a.c.1.c.c.a.-.1.9.c.1.-.4.d.6.f.-.9.0.c.d.-.9.9.b.c.3.c.d.3.d.3.5.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.4.c.-.0.0.0.1.-.0.0.1.4.-.2.1.7.a.-.6.2.3.d.e.a.c.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.1.3.1.2.d.8.e.2.1.c.7.a.c.0.f.c.f.1.f.6.4.0.6.7.6.9.0.1.5.1.a.8.6.7.3.8.c.8.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_2699415f5fdb1b8726d39a1517f1ac2e93897fae_f4fd270f_cbd5ed6f-f1b1-46e2-ae61-8477867d2156\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0422345584921138
Encrypted:	false
SSDEEP:	192:sWnlCaizB8Sm0M8rr6E6jj/ZrUUJcUzuiFUZ24IO8q6t:VB2B/NM8rCjqUzuiFUY4IO81
MD5:	C0431A2587EB820FB4A4C20BC036784C
SHA1:	C33FB2409D94FB73BB9898BC566DC6896691D741
SHA-256:	BA92B9ABA9F5AD9994A0FF2EA18A3628B63294D000E9CA71CB2C988A98556FED
SHA-512:	E1D69160A2C80F6539A562EBC7DE7F111A60C75DCD7B5F608C7B0DD43EADA52BE65C9F52447F28EFDABBCB6134771335F927D348D5E2B7C6222726A8BD3293E0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.4.5.1.0.2.4.9.2.2.9.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.4.5.1.0.5.1.7.9.7.8.1.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.d.5.e.d.6.f.-.f.1.b.1.-.4.6.e.2.-.a.e.6.1.-.8.4.7.7.8.6.7.d.2.1.5.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.0.7.f.4.e.f.f.-.7.6.e.d.-.4.d.f.2.-.9.5.d.1.-.a.6.e.8.7.2.6.7.4.a.d.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.6.4.-.0.0.0.1.-.0.0.1.4.-.6.6.6.1.-.a.d.3.d.e.a.c.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.1.3.1.2.d.8.e.2.1.c.7.a.c.0.f.c.f.1.f.6.4.0.6.7.6.9.0.1.5.1.a.8.6.7.3.8.c.8.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_7c9841f9f13651f5ded4f2d68b2cd516a5a13a6c_2a26eb84_b7177fe9-08e6-4125-bc00-27f903d61e18\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.055244816918044
Encrypted:	false
SSDEEP:	192:I/fIPg05d0HBuY/FjyZrofxjPzuiFUZ24IO8+:gIg05eHYY/FjLPzuiFUY4IO8+
MD5:	F462139BA8B8262A78B6E86F4E0983F7
SHA1:	DC751ED0AE1443AAEEC3216DE7D6BB4A247DFE8A
SHA-256:	45DBC5A81BC16F60F1375CE80EF0395EF92B1DF12F7F8BAB779BE008A3AD62AD
SHA-512:	991B049C19ED47FBA9D781BEF54E88A3DAE0E6E0C47DAF557317C57942CD73CB9873BC3E2CA886D7662B8C9BB164550F85DD6D9E05A91C71A0357F1719669B11
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.4.5.1.0.9.4.3.0.8.0.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.4.5.1.0.9.9.7.7.6.7.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.7.1.7.7.f.e.9.-.0.8.e.6.-.4.1.2.5.-.b.c.0.0.-.2.7.f.9.0.3.d.6.1.e.1.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.8.4.7.d.9.b.-.a.7.3.3.-.4.8.e.8.-.a.f.c.c.-.9.8.8.7.b.a.1.8.0.e.d.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.b.0.-.0.0.0.1.-.0.0.1.4.-.8.1.7.4.-.5.9.4.2.e.a.c.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.1.3.1.2.d.8.e.2.1.c.7.a.c.0.f.c.f.1.f.6.4.0.6.7.6.9.0.1.5.1.a.8.6.7.3.8.c.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER494.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 08:18:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	98526
Entropy (8bit):	2.0831236419327768
Encrypted:	false
SSDEEP:	384:Zk8OxBg7hqFtvPTAQfQOf1O3Zsg6xelJ+vVkTCz5JqCpWC7h:ZkDS0FtvPBfH+YkGz5pWC7h
MD5:	0D2228D47F7D055CB76F78858CA36155
SHA1:	3523BDADD73CC422D64C4DB7AB83F8A98AFDCD23
SHA-256:	1B63EECA3612F39E712499028F29B66BEFFA37370B713C2D0630B776EB3795D1
SHA-512:	5516B86640489AEEB8C8B463F31BACACA95CB4CD2B9E7CEBC5E16D4CE3668857E77EF43AF4C8DBE26CFC47C666FBCBE7EEC72F66E0A08A891D829A6713ECFA62
Malicious:	false
Preview:	MDMP..a..... .........sf....................................l...`#...........J..........`.......8...........T........... J...6...........#...........%..............................................................................eJ......P&......GenuineIntel............T.............sf............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER541.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8390
Entropy (8bit):	3.6998819399942935
Encrypted:	false
SSDEEP:	192:R6l7wVeJXj6HaM6OZ6Y9dSUPgmfpJJduxpr3q89boEsfTYm:R6lXJz6HwOZ6YXSUPgmfpJJMvo3fp
MD5:	E3EE40DFB3F629C3F4B1FD534269FA72
SHA1:	F8C34C666589CB75E6F4F304DFA61BE8FA89CEEF
SHA-256:	8B88941566B141B70677064864EB2F65937342A12157F60D99BE8F8F3EF3EB34
SHA-512:	3FC0E0C1C2A38BEEBF6F07CAFCE50497BFE110A1FD7B0D7801F6813504463B66676846AB2B6F9D1883B0DF4DA40695681E9B019D12091F980F347DD3568C3603
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER59F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4708
Entropy (8bit):	4.508252469030146
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9fcWpW8VYw5Ym8M4JliFp+q8xV28OL7sd:uIjf0I79V7VGJ038k7sd
MD5:	2056FC5DF7974687E92345E3921CB1F8
SHA1:	2BEEC10B22843AC239D573A378607216BEEF6673
SHA-256:	65A4C7CE7C8F360CCB060A9678447C0836AFAE5C3B9DDD26E01B7F2F4B1A392A
SHA-512:	DAD4F5C0432941795833471913B2FACFE43A93348E2595F4FA5876DE4AD1411B7D68D49FD83F147AA2A8B77668D5CD36EC79B893B243FDB8344C82F9B79B3211
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="375801" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8A0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 08:18:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	98864
Entropy (8bit):	2.0846357366111814
Encrypted:	false
SSDEEP:	384:4wIoE4E0GFtvzQbuPU5e3iLEYE9zMd6sm8XqIcycHo:fgJ/FtvOtE5vN8YHo
MD5:	137E470ABCC6544E378959E5C773B350
SHA1:	0F12E4CAE9323EDDDB0F6DD66F4A30E776E23F8B
SHA-256:	068C76CA6E6AF56493261596817BF9F33F413D5FE8E17D5B4B7C8A876AD206AB
SHA-512:	AF5CC2A0737239AA68F224899FE1A34E7DD7615A93C41B70B3F3159A6D1B6AB35636462ADD424D610DBC7146280C62E5683E136F0F62A4A8C8E36CF31E16970F
Malicious:	false
Preview:	MDMP..a..... .........sf....................................l...`#...........J..........`.......8...........T............J...7...........#...........%..............................................................................eJ......P&......GenuineIntel............T...........~.sf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE97A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 08:18:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103516
Entropy (8bit):	2.043898384250572
Encrypted:	false
SSDEEP:	384:QADS1xtVRtvEldfxRiwOHx247vFzOb+WikEXD4TATJMd5GZGh+zm:j27DRtvkOP1OiW3EA+zm
MD5:	1A01510DB1D339605758F6BB1F0ACC08
SHA1:	DAD958A0B384CE596C1E7B7298ED885EF0567C2C
SHA-256:	277FE08018C33D9687599F4AB8BBCE3A0AF17262C0BDC071EF8B018B6FB16843
SHA-512:	B589C540C50F03D2CB3A551E36B90C8993828EB680F381AE56D28677741C847B7E934B0F03CD279AB2B85D8066A76DABFBA1AB8A1B0286909443438A908C1554
Malicious:	false
Preview:	MDMP..a..... .........sf........................,...........l...$#..........rL..........`.......8...........T............H...K...........#..........\|%..............................................................................eJ.......&......GenuineIntel............T.......d.....sf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAE2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 08:18:23 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	104256
Entropy (8bit):	2.0522571941441634
Encrypted:	false
SSDEEP:	384:t2WK1jrDFtvWhoA0mG8z3MVBykpwS26tuHX/T18S0KQ7jmXGvjJ9KVONXxc:M9xDFtvMSgS2UaL18nKqc
MD5:	EC19B1A25DF96C50AD9E1899807776D9
SHA1:	F11C99B9DB9C2A2320342E15A025B921EDE94FE6
SHA-256:	2F42515435085A1EE00DA246283E93CB0FCF90F8F11AB96A59F426AE2D954495
SHA-512:	D1BFC3187E667FF2CC2E09D7907DD64D3851F40F2ADA063D975E8CA2D4691B881CFF036C390419E2C7F52DC1BC9A012E73902F55947644CF5A1400063555C206
Malicious:	false
Preview:	MDMP..a..... .........sf....................................l....#...........L..........`.......8...........T...........HJ...L...........#...........%..............................................................................eJ.......&......GenuineIntel............T.......L.....sf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB9E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8394
Entropy (8bit):	3.706538928850102
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4h6ByQ6Y9+SUXgmfWJJBcprA89biwsfFWm:R6lXJ26ByQ6YUSUXgmfWJJyiDfN
MD5:	23DC57D9775B7B7F4C4BEED3C6AFFF45
SHA1:	FEA73A31F392E0CEBC8C15B15E5AA59F11037953
SHA-256:	EF375401190AB4102D85603D34BBB6EE6BCA2D49B2B8C23C459130FF92D945AB
SHA-512:	49115D51255047E1B0880DDBC931F54344167A9008578EE831FD2134142B4C16A2BEB43129657FCD4887C3009580B7C70DB39EE6D104FA775F068CB8EDA41A27
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREBAE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	3.7266181533990443
Encrypted:	false
SSDEEP:	192:R6l7wVeJFuK6gbYYiJJJysprs89biWsfJWm:R6lXJp6gbYYaJJri1fR
MD5:	E4683DC54324929BCB52F197193A4F84
SHA1:	5A0B83AC8A42B29184F9219705349948DCFD1D83
SHA-256:	B2B000614E02CBC0BCB8616DD523C0AC550B73D497BD7E67B6E8F3B3C22C035C
SHA-512:	DF06ADA8D9D7F4C0E649E8ACCC34381F8769CE7C724EE2CFB234B4AAF4A7F7F6C86D97D981847C5E0E742F8C73AFBB59E3985C8762E24E5EE112C7EDBDF7CA10
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED16.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4713
Entropy (8bit):	4.521788315529
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9fcWpW8VYCYm8M4JYQVFJ+q8W1i8QF7d:uIjf0I79V7VqJYoli8QF7d
MD5:	220B5143E7163DC9F3772A0C3074B5FE
SHA1:	EDE0C7465787EEC8D8B065FD0544132B91262CA3
SHA-256:	9FF99BC2B6FE96A1695AB0A2C2FF1F6019F3628767023585DEC4CBDA676BA131
SHA-512:	0EDD89EA1C21338DD6AEB31908922FCCF0804679207FE88619D81F4A46461204C3D17438CCD08970881D435EEB35DE80F7BF5364F4051A63F946B1857AC07B2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="375801" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF052.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.51522517502716
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9fcWpW8VYfYm8M4JHjFm+q8i18qPn9d:uIjf0I79V7VvJAl8qP9d
MD5:	095D3E11F5E7B7E3FA3EB146FC6552C4
SHA1:	ED01E88719D45C38057110D95D03F74ADC98AE80
SHA-256:	BFBBB96F7CA0B735209BE34014DC450242CA1EDA3EB2581C23935906AC001D4C
SHA-512:	77F3A9A72DF6652D90E935F9E61854EAFC52F3A1FE9EC9C8103378998C72CB35611D5AAD03856CA9E378AA36B4FEC608697DBB23AA767D55D99D272C11B8B133
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="375801" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1C8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	3.7290748840292607
Encrypted:	false
SSDEEP:	192:R6l7wVeJDu96dp67NYiJJJysprY89bdJsf6L/m:R6lXJI6dp67NYaJJ3dif66
MD5:	1BA563DC145FECEBC2A1E153192D6FD5
SHA1:	820597A1481060E03F8F1B404C2A3D460EECFE7B
SHA-256:	37BE97297320864C8B94F3BB898D470419A92DDB317832840EB8125153FA4B06
SHA-512:	5934FD053A43B0911E696AB2DDD79343E62AA0E05DEC083184710A26FFDD3BDAF9DC940A5859CFD0BA789C11114123D630C4AD1F62233F7F1E70ACD117DD5225
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2D3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.514496948397311
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9fcWpW8VY/4Ym8M4JHjF4+q8in8qPn2d:uIjf0I79V7V8JGX8qP2d
MD5:	CA632631A820F65324A68064A9CC9642
SHA1:	92CE6A7DEA31381F8AF2DB7E73DFA271BFFF0930
SHA-256:	01D27A71DDFFACAC17664768CCB74793E903FCA74F67C3017F23D54C84E0579A
SHA-512:	E8DC9A20B03DB225949562354106A2760588E81E94366DFF99A5993919D14589CB554B6107DFE2B3D97E8A5EB8A43A96AB775637C5DF3B45FECB10D871FA5AAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="375801" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3285520
Entropy (8bit):	7.9670682991434125
Encrypted:	false
SSDEEP:	49152:YQqdyW2QvYnYuHn2XYMGpokbLH+WYbIloN32VjGFbNNv9sCLBfqKtt/LBs3r7G8b:YQCyrmYnYiLlPbL2MVQYCVXLOaxc
MD5:	093BDA46F4EBE927A99CC0E120D50D8C
SHA1:	1312D8E21C7AC0FCF1F64067690151A86738C856
SHA-256:	FFD113A300E84AA5E0F426F711104FB6F6AC411A5C02F620433A0BD76E30B141
SHA-512:	83C2E93B5DDCA444391AFCB7229EC2EE2ED40F1637C05C4984F907D00643D8023B7EC344AE17410114CB123FB05A8F693866349318AFB3844C39FEBABE06A475
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X.X...........@...........................~.......2......................................a..........8.....................~..............................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..>..........x..............`....boot.....&...X...&..x..............`..`.reloc........~......"2................@................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\O2ikhRyQ71SvrRUjZ9MvGf7.zip

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5547
Entropy (8bit):	7.904251445531728
Encrypted:	false
SSDEEP:	96:5WGzqeAoMq+YK0KF8cAJiI2i+u2YTFu/pIw9jV1/saPsR9UY3KJv:NqASpF8wFiTk/pICjVXERmY6Jv
MD5:	9C2E6B1161B0B928F024CF6EECF5B795
SHA1:	038DC3D47E04ACEDD0EEEA4C6D7CEC82E2A05071
SHA-256:	7E0E3FB84B11F73614F68BCB4EC0B34B5AE4D1183AC9B2C1440084CC561B66AF
SHA-512:	FDE6993F968607F8268FD5EF9F8EB6311BF6D9032244BE28459557882A32050A48AEFFEC553476D26A7F77137FB14BE2804816F17001B42B836CB7C11E520FED
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\O2ikhRyQ71SvrRUjZ9MvGf7.zip, Author: Joe Security
Preview:	PK........I".X................Cookies\..PK........I".XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\Sfn1YyGgu6CGTeBtRcADBVG.zip

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5599
Entropy (8bit):	7.90321279480738
Encrypted:	false
SSDEEP:	96:5WGzqeAoMq+YK0KF8cAJiI2i+u3RyIKpJKCNCeoLgN3naw3KJH:NqASpF8wFmcosNXaw6JH
MD5:	B19D322AE5AF30EB3B37F6298A29FB8D
SHA1:	D84112EEE08B2D0BB311AA4C62C632CFE943C128
SHA-256:	A74F49AD0C72BC36C3853C2B9A72CDFCC3FA501F1E54B57D2A4F2DF83A3236E3
SHA-512:	EE343D44CD7D6AC366434649E5ED32EA389332615D4F64D2819687A66CDCF229A0ED396734747E16638B0CE11BA162DDA9C1308B7DE424419C117DB09FE10031
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\Sfn1YyGgu6CGTeBtRcADBVG.zip, Author: Joe Security
Preview:	PK........L".X................Cookies\..PK........L".XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\UWUWkzI6iEQD6XYchYfKNkl.zip

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5609
Entropy (8bit):	7.903050173225737
Encrypted:	false
SSDEEP:	96:5WGzqeAoMq+YK0KF8cAJiI2i+uL9OhH5iWrkCD7Tz2zHih3KJM5s:NqASpF8wFHH5iW/D7Tz6Ch6JMS
MD5:	C70246219F3EB47BEF8D51C67C322F15
SHA1:	D6444F3CDB26F625ED06CF816DCC93663ACE65A1
SHA-256:	8734306A8019687546910ACC4427FB0EAF2C2ED4231E91FA0719D88941570FBC
SHA-512:	577851C396552ABEEFA1199115A7909BB715E16FB1A35CEEB2DFC764B7647D6A4B9B204D4EEB906FF52C37AD40E8955E8722FD632A4AF0546079B06A9F1F3B11
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\UWUWkzI6iEQD6XYchYfKNkl.zip, Author: Joe Security
Preview:	PK........P".X................Cookies\..PK........P".XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\hOyPUaIJ5lfWhg1CogD2H0Y.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5625
Entropy (8bit):	7.894707877322794
Encrypted:	false
SSDEEP:	96:LUT29vHz9WQBavDziBP1Pe4McobRHSIL0cR7MpsFFv1v6lsm1b3KJc:LUT29Hz9WGFh1Pe4q48R7MOFBwb6Jc
MD5:	A78D9E07F8D39828E1F6CD104ED8D674
SHA1:	FFD9F92409FE3661E1D68FA72CBBE68F86052BD7
SHA-256:	E28BE53A32D01484816BA3FA59B325FFD2E9778F7AA2D7D52BB0387AAEAF5317
SHA-512:	36D8B337D8299752EE224191FFCE90B9C021AD92D7D47485590FC1352771ADF712BC4035A38D6DA1DC4B2874876B1EC78B64E07380D4D7958FBA578D0DAC22AF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\hOyPUaIJ5lfWhg1CogD2H0Y.zip, Author: Joe Security
Preview:	PK........I".X................Cookies\..PK........I".X..s@..../......Cookies\Chrome_Default.txt.G.....5..G.BMx.....%.M...{...?.LH..71.t.....:y3..s./.0.m.%......../. ..!..A.C.........;...x...........!.2.....Z..<....<.h8..<.q;.....9....gK.}.R.#f...A.E...1...?lR....b.....nS=l.%E&'...>x......h.......E)C..t..'.2<Z_@.........&Lk......0..B.mqk.9M1lf.-e@....E.v..R&..\|..-....C.w.Y.K... ........k..3..2W5.!vs.....S.~.......0._.*..e.....U...).....>...g+;...z[Ks....Z..d...\|.".v..(...I....+.7.y.X@.H....eV.............Y..c..x...Kw.'S>.d\|.....B..k.p..\|C\|F.......O52....`f.3W..../....i..E...7..c.Kwv..,]..C..j.2.T..+............t.2....6.M>..s..K.M...VJ..>;.......n.<f;]s.K..5...n....~$ ....%......Z#.....Q5...<n...I&......0<:..>..I.K)g.)..KX.H.(Y!..j4W.j..1.V..d\.T..,p...D...T..>z...,.....L.....Mh.t..!....A...!?.U...x..[a7j.N;#..t.\.#.Z.-)f...v_.<..?..`.D0..?......).vX.#...Lw.j...1.....M.#...+.W....h....U.W....G.w......'.Y?.....;.....`...X...C..w..

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8731406795131336
Encrypted:	false
SSDEEP:	3:L0jSVce:wjSB
MD5:	D2EADC1CA1E58B14C6FB7DF4CE546369
SHA1:	5AB70200971C9214B6028BE4BF05825085863D33
SHA-256:	9AF77243567403FBC8F44AFE386B07904F54970D2C6211F2885C6440E5644DA5
SHA-512:	7FB0F29436831B8F2480CBEB3505FF7744813C7E6D9567BCB05DFFF141CD336EE8A423EF0AECF277FDC06196156A7BFAA3B245F0F242DB3C09786BC7DF086AE7
Malicious:	false
Preview:	1718875709649

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\8K3NvYKoF0DKWeb Data

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\AYzHdFopxO75Login Data

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\EqhKO9P2ECIWHistory

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\FpFVBgo7dSgCHistory

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\J7Touhh5YhR_History

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\JiGBQplW34HlWeb Data

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\Lchq51g992ItWeb Data

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\QmUB95Fj8NtJLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\UKIb9BrpbElGCookies

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\ZKqDW00W89j6Login Data

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\aSLZ4Feg28S4History

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\alNN5XcPfXotWeb Data

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\qSDPuLBbQcS_Web Data

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3x9gJBcQfMeS\r2pCRkIRP3etWeb Data

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\5QPDGmo5G4k0History

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\Aefi8eaYARX2Cookies

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\B1BYGVK1v4aYWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\NR3m_g5fQLPvWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\Qwkc0_mnr5I_Login Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\RQPZpHTwFV2JWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\X4w8fLfloerdWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\_1TNl_23bSjIHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\_cSHk0g_fG60Login Data For Account

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\b5K2F8rC2qaQLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\j9CgRYxfLi1HHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\owf9GshuzJ25Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\qZ4vtdSQrsMXWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6Nuw1ORO26gR\ziYYSl1GQLDDHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\9CGOzYIsW4fKLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\CW09Q1VnvrXtWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\H1q59R1WsqBZLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\MqnEX1xeniHjHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\P6vnPkfjmSpEWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\TGgMbIm7Fwe7Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\XA9cbBY_htD9History

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\bpSr9MYCACnDWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\fYwqiU7DWIRUCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\iAtg3fYFpooiWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\kAef6Yh1mDgwWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\lsAFEDVzYJlMHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\qUtwXB6UhnVfLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanJkYygiW7iXux\v9460BEWAmo6History

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\5T3tgwNhpORwLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\6SFuLgzL4qkfHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\8cbHFLCQ6whQHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\9t19K0e5OKG7Login Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\JiEe34kl27_ALogin Data For Account

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\O9ahXmBQyGuqHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\Xv5tHsOHXMC8Cookies

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\dfNgOBp6eddkWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\ewz6Vx4jFnkiWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\rQNWv9vcSm3gHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\t1K7aC5iYP_kWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\u1bz9SOgrSepWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\vNEEDJhgXMN9Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanglx2UtLzqYTr\z4FoeE1bFFHiWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy3x9gJBcQfMeS\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixy3x9gJBcQfMeS\information.txt

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7103
Entropy (8bit):	5.53465291656448
Encrypted:	false
SSDEEP:	96:xPsktORhfcT4Aisph+9hcBtNllfANUbg3x:xCvfvAtphWhcBtWB
MD5:	29450A486ACCDC544B361C13A2947730
SHA1:	D7D2665D7195FD6119F4F0ADE3A9357B25D0D6D7
SHA-256:	A2B8E9025306D94A99F3F4691D035C2026A995C7CC97EA417E006C94490B5E2D
SHA-512:	D87BA1DCF2695B4BBEA69EDA10CDB9CA7DBEF930BD06A099276985FA06DAF54777F0C4920AB7B93CCD3A37F1E25418EF00001C9C1BA4FD3CFE2D63CFEA642F9B
Malicious:	false
Preview:	Build: lamer..Version: 2.0....Date: Thu Jun 20 04:18:18 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: c81a725b497df1b73001a45a9a951bf2....Path: C:\Users\user\Desktop\D44CPdpkNk.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy3x9gJBcQfMeS....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 226533 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 4:18:18..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe

C:\Users\user\AppData\Local\Temp\trixy3x9gJBcQfMeS\passwords.txt

Download File

Process:	C:\Users\user\Desktop\D44CPdpkNk.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy6Nuw1ORO26gR\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixy6Nuw1ORO26gR\information.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7327
Entropy (8bit):	5.5430166033760795
Encrypted:	false
SSDEEP:	96:xP9kKORhYcT4Aisph+9hcBtNllUTdANUbg3x:xgvYvAtphWhcBtK+B
MD5:	A58E786FEC098052EEB73121A1C594B3
SHA1:	EA6863AFECF3B6D1BAF9C818B207D5FF3B552C0B
SHA-256:	ECD40204FFFCB894021C73BD1F62BE33CEBE9809E30C2BB460995FFB584F034B
SHA-512:	8F03C188F3824E8B1FAAE6CF72E7AD56678E7AF0BCCFC5E914506096F17AA152B4A789EE8B229242B7689AA3309BE9759C861F4F33CBEE07FB4ACE997A152BC9
Malicious:	false
Preview:	Build: lamer..Version: 2.0....Date: Thu Jun 20 04:18:33 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: c81a725b497df1b73001a45a9a951bf2....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy6Nuw1ORO26gR....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 226533 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 4:18:33..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..

C:\Users\user\AppData\Local\Temp\trixy6Nuw1ORO26gR\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyJkYygiW7iXux\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	12170
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	192:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WhHGYUnOTNC5IcXkWFXZQHRFJ5Pts7c3aP:gwsPbtKvCpqq40wsPbtKvCpqq47
MD5:	B6F52D24FC4333CE4C66DDA3C3735C85
SHA1:	5B69F1D66E95EFE2CF1710E9F58526B2AAEC67E4
SHA-256:	0FEE1A764F541EC6733DB89C823296650F6E581CD7D812D5A142B5A0AD9BC9B6
SHA-512:	CD2C6D64083061D7C7A7E89CF9C9F7D2B66301C73CFB56D2CCD94D1B810DE42774DAE5B77DB2E567A26FC54989C04D8A60D76225E6F3F91FCD2AE4D2E01F3C4C
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyJkYygiW7iXux\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7102
Entropy (8bit):	5.537254411985812
Encrypted:	false
SSDEEP:	96:xPskAORhfcT4Aisph+9hcBtNllfANUbg3x:x9vfvAtphWhcBtWB
MD5:	F83F1CE2B27BF3673BB2332124BFA7B7
SHA1:	5B556820EA0BB70EE0F02F7CB713507D66AC2321
SHA-256:	10F09287B2F470ECDBF8202315E648F25A8CB426ADD8C532E9DF7998458B8C58
SHA-512:	25AE7A44087F8330E7F12AB751706D5CE08697B0D76117D1B24379D9723DD01EF530EB84603C68CF7308DED449EE08BFF4D93E448398388933BBA06E8BD841B0
Malicious:	false
Preview:	Build: lamer..Version: 2.0....Date: Thu Jun 20 04:18:18 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: c81a725b497df1b73001a45a9a951bf2....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyJkYygiW7iXux....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 226533 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 4:18:18..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe

C:\Users\user\AppData\Local\Temp\trixyJkYygiW7iXux\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyglx2UtLzqYTr\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyglx2UtLzqYTr\information.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7284
Entropy (8bit):	5.54318683492064
Encrypted:	false
SSDEEP:	96:xPQkSORhbrcT4Aisph+9hcBtNllUT8ANUbg3x:xTvbrvAtphWhcBtKFB
MD5:	C5CC1CD51714674CC8EB98BF8E44D115
SHA1:	1714B04A3347B8C223A4B64A0C3FD703EFE2B344
SHA-256:	E7582754EC26F02A290ADF1182AD4E188B6BD54DCB338BC0FD8857DCE52C4C4F
SHA-512:	969B6FF3E05524D9E7E2D030CFE6B6CFF393A8D0849915486C27CC38C6EB1948075AFE5C4E202E0C39CCC50152E9FB4DF27BABDDC279C4ACF1396AD4EC0A3153
Malicious:	false
Preview:	Build: lamer..Version: 2.0....Date: Thu Jun 20 04:18:25 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: c81a725b497df1b73001a45a9a951bf2....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyglx2UtLzqYTr....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 226533 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 4:18:25..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..

C:\Users\user\AppData\Local\Temp\trixyglx2UtLzqYTr\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4690784072787455
Encrypted:	false
SSDEEP:	6144:DIXfpi67eLPU9skLmb0b4bWSPKaJG8nAgejZMMhA2gX4WABl0uNmdwBCswSbr:UXD94bWlLZMM6YFHo+r
MD5:	0DFD191D267AB13AA7A021C64CD48CC4
SHA1:	626A5B8AC78E735ED7686E82CAD6BA08E4A0D53D
SHA-256:	D57123BB043CB19A0657B94E68A3D1303F953FA986F125CA8ECAF665F57AA93A
SHA-512:	880349C4B2664EDFF1B5A2696B339DFAB806E8EB0F742791B00F22EB1E44234CD091AC699012885EDB76958A5B7DBEFFCB426F2CE5BD1742C773CE52A4E2E7B8
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..(j..................................................................................................................................................................................................................................................................................................................................................?^........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9670682991434125
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	D44CPdpkNk.exe
File size:	3'285'520 bytes
MD5:	093bda46f4ebe927a99cc0e120d50d8c
SHA1:	1312d8e21c7ac0fcf1f64067690151a86738c856
SHA256:	ffd113a300e84aa5e0f426f711104fb6f6ac411a5c02f620433a0bd76e30b141
SHA512:	83c2e93b5ddca444391afcb7229ec2ee2ed40f1637c05c4984f907d00643d8023b7ec344ae17410114cb123fb05a8f693866349318afb3844c39febabe06a475
SSDEEP:	49152:YQqdyW2QvYnYuHn2XYMGpokbLH+WYbIloN32VjGFbNNv9sCLBfqKtt/LBs3r7G8b:YQCyrmYnYiLlPbL2MVQYCVXLOaxc
TLSH:	7FE5337788A06FD0E428D4376E128DA52D4CB708EF171A7CF81F6EBD87092AC1379599
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	8596a1a0a1a1b171

Static PE Info

General

Entrypoint:	0x980058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x664C6914 [Tue May 21 09:27:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63814aaf116ba6abb6496ce4bcad24c6

Entrypoint Preview

Instruction
call 00007F4271116190h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F427111602Ch
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F4271116093h
xor eax, eax
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F4271116127h
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F427111604Ah
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F4271115FDBh
mov eax, 00000001h
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F427111602Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007F427111606Ah
mov ecx, 00000001h
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F4271116047h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F427111602Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19618b	0x184	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18a000	0x1638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7eb000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x197018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x18369c	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x15bbc8	0x9d200	52c8d8736a0729eed939fe5f4f1a45c2	False	0.999139195505171	data	7.986055415037788	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x15d000	0x27e32	0x10a00	dd142d0c89c8a53e3b197f2810bb5b10	False	0.994404957706767	data	7.955133990446104	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x185000	0x4930	0x800	b400e9aeb9cc9bd7a33c5117ab327465	False	0.99169921875	data	7.7930001205455435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18a000	0x1638	0x1800	fe6f3fdb9e7e97cba92d8ce4e4fcc95b	False	0.7220052083333334	data	6.54017046361188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x18c000	0x9858	0x7200	743c250778d161bdd0f0493fe8e22716	False	0.9791666666666666	OpenPGP Public Key	7.932641354500357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x196000	0x1000	0x400	1b20e07443fa333ff9692026d1e6c6c2	False	0.3984375	data	3.42439969016873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x197000	0x1000	0x200	54a50a058e0f3b6aa2fe1b22e2033106	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x198000	0x3e8000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x580000	0x26aa00	0x26aa00	8703c0bc81f9324d71aa69e65c797ce7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x7eb000	0x1000	0x10	f5bc99b71bad9e8a775cc32747e3ca58	False	1.5	GLS_BINARY_LSB_FIRST	2.474601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x18a440	0x1060	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.8838263358778626
RT_GROUP_ICON	0x18b4a0	0x14	data	Russian	Russia	1.05
RT_VERSION	0x18a130	0x310	data	Russian	Russia	0.45408163265306123
RT_MANIFEST	0x18b4b8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/20/24-10:18:18.266820	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49732	58709	192.168.2.4	77.91.77.66
06/20/24-10:18:12.891833	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	77.91.77.66
06/20/24-10:18:36.172836	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49747	58709	192.168.2.4	77.91.77.66
06/20/24-10:17:06.155610	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49731	58709	192.168.2.4	77.91.77.66
06/20/24-10:17:34.165292	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49747	77.91.77.66	192.168.2.4
06/20/24-10:17:10.831103	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49732	77.91.77.66	192.168.2.4
06/20/24-10:18:27.329405	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49734	58709	192.168.2.4	77.91.77.66
06/20/24-10:17:26.653501	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49747	77.91.77.66	192.168.2.4
06/20/24-10:17:18.297909	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49734	77.91.77.66	192.168.2.4
06/20/24-10:17:06.743077	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49731	77.91.77.66	192.168.2.4
06/20/24-10:17:10.864562	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49733	77.91.77.66	192.168.2.4
06/20/24-10:18:18.313506	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49733	58709	192.168.2.4	77.91.77.66
06/20/24-10:17:23.519101	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49731	77.91.77.66	192.168.2.4
06/20/24-10:17:23.729447	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49732	77.91.77.66	192.168.2.4
06/20/24-10:17:23.804516	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49733	77.91.77.66	192.168.2.4
06/20/24-10:17:28.105368	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49734	77.91.77.66	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 10:17:06.099227905 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:06.104626894 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:06.104809046 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:06.155610085 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:06.160589933 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:06.743077040 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:06.797854900 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:09.876025915 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:09.881118059 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:10.208444118 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:10.210933924 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:10.213643074 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:10.213826895 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:10.215905905 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:10.216223955 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:10.225145102 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:10.226917982 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:10.230117083 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:10.232111931 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:10.831103086 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:10.864562035 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:10.875714064 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:10.907047033 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:13.954024076 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:13.959162951 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:13.985280037 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:13.990236044 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:17.661423922 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:17.666717052 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:17.666903973 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:17.677304983 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:17.682183981 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:18.297909021 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:18.344558954 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:21.438500881 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:21.443624973 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:23.519100904 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:23.563210964 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:23.664916039 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:23.664949894 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:23.665041924 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:23.666436911 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:23.666454077 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:23.729446888 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:23.781990051 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:23.793968916 CEST	49742	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:23.794006109 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:23.794178963 CEST	49742	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:23.794912100 CEST	49742	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:23.794929981 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:23.804516077 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:23.860070944 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:23.891184092 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:23.891211987 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:23.891320944 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:23.893042088 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:23.893054962 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.175169945 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.175244093 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.179012060 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.179023027 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.179442883 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.219439030 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.229125023 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.276508093 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.304908991 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.304984093 CEST	49742	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.306015015 CEST	49742	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.306020021 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.306523085 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.357347965 CEST	49742	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.365065098 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.365209103 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.365422010 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.368325949 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.368338108 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.368347883 CEST	49741	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.368352890 CEST	443	49741	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.376141071 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.376281977 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.379287958 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.379300117 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.379633904 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.380201101 CEST	49744	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.380237103 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:24.380402088 CEST	49744	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.380763054 CEST	49744	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.380785942 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:24.404511929 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.422576904 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.492448092 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.492783070 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.493145943 CEST	49742	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.493418932 CEST	49742	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.493423939 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.493446112 CEST	49742	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.493448973 CEST	443	49742	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.505783081 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.510359049 CEST	49745	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.510428905 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:24.510499001 CEST	49745	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.510838032 CEST	49745	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.510875940 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:24.552504063 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.636881113 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.637011051 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.637125015 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.639661074 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.639678001 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.639714003 CEST	49743	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:24.639723063 CEST	443	49743	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:24.641890049 CEST	49746	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.641938925 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:24.642030001 CEST	49746	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.642402887 CEST	49746	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.642436028 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:24.915111065 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:24.915205956 CEST	49744	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.918688059 CEST	49744	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.918720961 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:24.919152021 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:24.929496050 CEST	49744	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:24.972548962 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.000758886 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.000839949 CEST	49745	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.003671885 CEST	49745	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.003691912 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.004045963 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.011781931 CEST	49745	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.052520990 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.072599888 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.072779894 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.072983980 CEST	49744	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.075156927 CEST	49744	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.075191975 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.075222969 CEST	49744	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.075239897 CEST	443	49744	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.075511932 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:25.080528021 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:25.130089045 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.130166054 CEST	49746	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.131689072 CEST	49746	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.131705999 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.132056952 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.139875889 CEST	49746	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.175170898 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.175409079 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.175479889 CEST	49745	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.176538944 CEST	49745	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.176572084 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.176599026 CEST	49745	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.176614046 CEST	443	49745	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.177027941 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:25.180529118 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.182739019 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:25.300304890 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.300393105 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.300565004 CEST	49746	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.300645113 CEST	49746	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.300664902 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.300693989 CEST	49746	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:25.300705910 CEST	443	49746	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:25.300890923 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:25.305720091 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:26.012569904 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:26.018178940 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:26.018457890 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:26.037734985 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:26.042701960 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:26.653501034 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:26.703984976 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:27.770447016 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:27.813350916 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:27.923660040 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:27.969573975 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:27.970293045 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:28.016474009 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:28.105367899 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:28.156949997 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:28.218394995 CEST	49748	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:28.218441963 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.218523979 CEST	49748	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:28.219547033 CEST	49748	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:28.219582081 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.746645927 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.746773958 CEST	49748	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:28.747967005 CEST	49748	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:28.747998953 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.749087095 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.797795057 CEST	49748	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:28.844578028 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.930932999 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.931258917 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.931345940 CEST	49748	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:28.938054085 CEST	49748	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:28.938055038 CEST	49748	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:28.938124895 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.938160896 CEST	443	49748	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:28.941462040 CEST	49749	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:28.941520929 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:28.941581964 CEST	49749	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:28.941940069 CEST	49749	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:28.941951990 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:29.437264919 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:29.437448978 CEST	49749	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:29.438594103 CEST	49749	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:29.438605070 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:29.439559937 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:29.440668106 CEST	49749	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:29.488500118 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:29.596760988 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:29.597060919 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:29.598628044 CEST	49749	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:29.598777056 CEST	49749	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:29.598777056 CEST	49749	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:29.598798990 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:29.598809958 CEST	443	49749	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:29.599154949 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:29.604096889 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:29.784321070 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:29.792171001 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:30.255444050 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:30.297633886 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:30.329090118 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:30.334436893 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:32.637208939 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:32.688419104 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:32.719985008 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:32.724347115 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:32.727488995 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:32.750978947 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:32.756269932 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:32.830621004 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:32.875724077 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:34.165292025 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:34.219520092 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:34.265665054 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.265752077 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.265990019 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.267189026 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.267225981 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.764332056 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.764460087 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.770678997 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.770694971 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.771761894 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.813246012 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.836679935 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.884510994 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.970978975 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.971282959 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.971365929 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.971630096 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.971648932 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.971676111 CEST	49750	443	192.168.2.4	34.117.186.192
Jun 20, 2024 10:17:34.971683979 CEST	443	49750	34.117.186.192	192.168.2.4
Jun 20, 2024 10:17:34.974781036 CEST	49751	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:34.974884987 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:34.974973917 CEST	49751	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:34.975333929 CEST	49751	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:34.975373983 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:35.475207090 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:35.475342035 CEST	49751	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:35.476944923 CEST	49751	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:35.476980925 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:35.477910995 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:35.479497910 CEST	49751	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:35.524539948 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:35.629148960 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:35.629384995 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:35.629489899 CEST	49751	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:35.629904032 CEST	49751	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:35.629904032 CEST	49751	443	192.168.2.4	104.26.4.15
Jun 20, 2024 10:17:35.629941940 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:35.629967928 CEST	443	49751	104.26.4.15	192.168.2.4
Jun 20, 2024 10:17:35.630155087 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:35.634969950 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:37.469476938 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:37.516508102 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:37.563514948 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:37.568661928 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:37.683934927 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:37.710232973 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:37.735217094 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:37.750757933 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:37.766654968 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:37.771889925 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:37.782234907 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:37.787170887 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:37.818434954 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:37.860143900 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:37.907545090 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:37.912900925 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:38.145900965 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:38.188437939 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.323869944 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.323921919 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.323960066 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.323997021 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.324006081 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.324031115 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.324073076 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.324193001 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.324193001 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.324255943 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.324285984 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.324346066 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.324578047 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.324636936 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.324687958 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.324898005 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.324928045 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.324984074 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.325697899 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.325788975 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.325824022 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.325848103 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.329014063 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.329054117 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.329078913 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.375827074 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.437634945 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.437731981 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.437764883 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.437802076 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.437812090 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.437894106 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.437994957 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.438025951 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.438076019 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.438448906 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.438504934 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.438539982 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.438560009 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.438595057 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.438647032 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.439078093 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.439229012 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.439281940 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.439397097 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.439425945 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.439479113 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.439488888 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.443254948 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.443311930 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.443314075 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.443350077 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.443404913 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.451544046 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.451652050 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.451689005 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.451723099 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.451864958 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.451900005 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.452016115 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.484015942 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484074116 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484103918 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484131098 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.484159946 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484208107 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484241009 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484297037 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484328985 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484344006 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.484344959 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.484380007 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.484656096 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484711885 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484745026 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.484767914 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.484981060 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.485009909 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.485038996 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.485181093 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.485232115 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.485239983 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.489218950 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.489274025 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.489305973 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.489325047 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.489362001 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.500735998 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.547780991 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.552778006 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.557132006 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.557208061 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.557241917 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.557266951 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.557313919 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.557348013 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.557380915 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.557384014 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.557437897 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.571293116 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.610033989 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.610141039 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.610198975 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.610235929 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.610271931 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.610300064 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.610300064 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.625726938 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.625910044 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.630855083 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.657082081 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.657298088 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.657299042 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:39.662439108 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:39.662530899 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:42.594738960 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:42.599802017 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:45.031604052 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:45.078937054 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:45.103651047 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:45.109045029 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:45.844744921 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:45.849870920 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:45.891428947 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:45.896718979 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:46.393040895 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:46.423686981 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:46.428916931 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:46.483315945 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:46.514405966 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:46.532289982 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:46.532310963 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:46.532311916 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:46.537578106 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:46.537622929 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.638257027 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.638315916 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.638354063 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.638376951 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.638458967 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.638499022 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.638516903 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.638534069 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.638591051 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.639236927 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.639296055 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.639329910 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.639352083 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.639441013 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.639496088 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.639499903 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.639659882 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.639715910 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.639715910 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.639899969 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.639955044 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.639955997 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.643439054 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.643520117 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.763221025 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.763264894 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.763328075 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.763345003 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.763364077 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.763405085 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.763422012 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.763436079 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:48.763515949 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.844674110 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:48.851754904 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:51.922765017 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:51.927807093 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:52.156202078 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:17:52.203933001 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:52.223114014 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:17:52.228045940 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:01.548214912 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:01.553495884 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:09.771686077 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:09.813333035 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:09.839148998 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:09.847548008 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:09.891442060 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:09.891442060 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:09.930365086 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:09.985174894 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.016592979 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.061461926 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.450558901 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.450617075 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.450666904 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.450704098 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.450735092 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.450767994 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.450803995 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.450803995 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.450841904 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.450872898 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.451013088 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.451013088 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.452053070 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.452097893 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.452157974 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.452195883 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.452229977 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.452249050 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.452267885 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.452270985 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.452306986 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.452338934 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.457133055 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.457178116 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.457211971 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.500855923 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.582837105 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.582885981 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.582921982 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.582954884 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.583034039 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.583034039 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.587733984 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:10.641577005 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.672996998 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:10.678626060 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:12.891833067 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:12.898283005 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:15.063786983 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:15.110184908 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:15.126087904 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:15.152802944 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:15.172823906 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:15.203927994 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:15.256623983 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:15.303406000 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:15.522922993 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:15.563313007 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:18.266819954 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:18.271995068 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:18.313505888 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:18.318500996 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.300472021 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:19.300673008 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:19.305639029 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.305685997 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.305731058 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:19.306149960 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.306180000 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.306209087 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.306237936 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.310823917 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.325907946 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:19.325907946 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:19.330872059 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.330900908 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.330941916 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:19.330950022 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.330979109 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.331305981 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.331334114 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.335776091 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.695523977 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:19.695523977 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:19.700522900 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.700606108 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.700644016 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.700651884 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:19.700674057 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.700903893 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.700932026 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:19.705454111 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:22.476881981 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:22.482408047 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:22.482470036 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:22.563482046 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:22.568696976 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:22.568876028 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:22.814629078 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:22.823445082 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:22.823515892 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:24.199177980 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:24.250819921 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:24.456270933 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:24.457531929 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:24.465256929 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:26.921827078 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:26.921827078 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:26.926934004 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:26.926958084 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:26.927022934 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:26.927103043 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:26.927206993 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:26.927222013 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:26.927342892 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:26.931813002 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:27.329405069 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:27.334283113 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:29.954092979 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:29.960040092 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:29.960154057 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:33.058661938 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:33.110239029 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:35.102158070 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:35.102247000 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:35.107204914 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:35.107232094 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:35.107247114 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:35.107259035 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:35.107271910 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:35.107275009 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:35.107284069 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:35.112075090 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:36.172836065 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:36.178922892 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:38.188453913 CEST	49747	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 10:18:38.193845034 CEST	58709	49747	77.91.77.66	192.168.2.4
Jun 20, 2024 10:18:38.193927050 CEST	49747	58709	192.168.2.4	77.91.77.66

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 10:17:23.651736975 CEST	49584	53	192.168.2.4	1.1.1.1
Jun 20, 2024 10:17:23.660598993 CEST	53	49584	1.1.1.1	192.168.2.4
Jun 20, 2024 10:17:24.370682955 CEST	62744	53	192.168.2.4	1.1.1.1
Jun 20, 2024 10:17:24.379420996 CEST	53	62744	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 20, 2024 10:17:23.651736975 CEST	192.168.2.4	1.1.1.1	0xa118	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jun 20, 2024 10:17:24.370682955 CEST	192.168.2.4	1.1.1.1	0x38e4	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 20, 2024 10:17:23.660598993 CEST	1.1.1.1	192.168.2.4	0xa118	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Jun 20, 2024 10:17:24.379420996 CEST	1.1.1.1	192.168.2.4	0x38e4	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 10:17:24.379420996 CEST	1.1.1.1	192.168.2.4	0x38e4	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 10:17:24.379420996 CEST	1.1.1.1	192.168.2.4	0x38e4	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

https:

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49730	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:16:56 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-20 08:16:57 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 08:16:56 GMT content-type: application/json; charset=utf-8 Content-Length: 319 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 08:16:57 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	34.117.186.192	443	7344	C:\Users\user\Desktop\D44CPdpkNk.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:24 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 08:17:24 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 08:17:24 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 08:17:24 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 08:17:24 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	34.117.186.192	443	7524	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:24 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 08:17:24 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 08:17:24 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 08:17:24 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 08:17:24 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	34.117.186.192	443	7500	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:24 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 08:17:24 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 08:17:24 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 08:17:24 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 08:17:24 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	104.26.4.15	443	7344	C:\Users\user\Desktop\D44CPdpkNk.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:24 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 08:17:25 UTC	653	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 08:17:25 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9BD7:30A6_93878F2E:0050_6673E595_149F96A8:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E6tIcTdLROUGf5WhhVlSPJxw7NWaFTc7XltMHvB%2BA77i7cEMHW4PhWo1KunnCLq8Q7hJho2THRzZ7w0W%2FZOvE6SPqoVuehawPl1wvjgAVlbhCvq4LPyZATaHrQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896a52832c4543ad-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 08:17:25 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 08:17:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	104.26.4.15	443	7524	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:25 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 08:17:25 UTC	659	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 08:17:25 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4672F1:A97A_93878F2E:0050_6673E595_14B3EA7E:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JbhPTjpt0EMV3o2gfrAVkTccXzY36XozvvWsvmB6xBqG9bfK7Kx9CABz5krBWUnwh%2F%2FHkJR6ori16Fp09HRdWrifAt1gQjddSz%2Bzxs5BXRyPT0zjJWztt%2FO%2BhA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896a5283c84a32d0-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 08:17:25 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 08:17:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	104.26.4.15	443	7500	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:25 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 08:17:25 UTC	659	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 08:17:25 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E3EA7:3056_93878F2E:0050_6673E595_149F96B4:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1AixWH%2BvoblDvrHNujQwC9AEOZRSnDjdvKdasoPALURQFT50LVkp%2FqnIvfr5fcpCPMV3WiQ3aLhrQcDoE8KquMVcNym5pX%2BSyVBeyt%2FnNiBh49mS4O5NLu%2Fl0A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896a52849931c325-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 08:17:25 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 08:17:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	34.117.186.192	443	7600	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:28 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 08:17:28 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 08:17:28 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 08:17:28 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 08:17:28 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	104.26.4.15	443	7600	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:29 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 08:17:29 UTC	651	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 08:17:29 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9AE3:8A24_93878F2E:0050_6673E599_14B3EB81:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTlvwJJMPdkV7a5KyQYe7x23dZxvDa%2BRcqa68zKMospvfnWSfmX5ytg73WlfOrDiYEr5ej8lorJs7Ectw3IjLwO5HxFlZjqNZGCt8qktw1WQjUSMrsJBke4JGw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896a529f6845430f-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 08:17:29 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 08:17:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	34.117.186.192	443	7924	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:34 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 08:17:34 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 08:17:34 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 08:17:34 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 08:17:34 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	104.26.4.15	443	7924	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 08:17:35 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 08:17:35 UTC	661	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 08:17:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9A7A:4CE6_93878F2E:0050_6673E59F_149F9946:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6CDMdkCIEVzjrQ2Ar7UAQl5Fh%2BuhTKxgxDpRQEHVAonfN%2BG%2Bfi%2FxydIUNjb1oPQ0e0uIS%2BB2nzJfkX25bjmaouuEmyLiVSZBIoJI4Isy98vv5TTMtlyL9%2BGfkg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896a52c52b3f5e70-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 08:17:35 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 08:17:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	04:17:02
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\D44CPdpkNk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\D44CPdpkNk.exe"
Imagebase:	0x400000
File size:	3'285'520 bytes
MD5 hash:	093BDA46F4EBE927A99CC0E120D50D8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2506747814.0000000005660000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2689948014.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2691142764.0000000005660000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:17:04
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xbd0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:17:04
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:17:04
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xbd0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:17:04
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:17:06
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'285'520 bytes
MD5 hash:	093BDA46F4EBE927A99CC0E120D50D8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.2704555272.0000000005760000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.2478743277.00000000057C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2703127000.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:17:07
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'285'520 bytes
MD5 hash:	093BDA46F4EBE927A99CC0E120D50D8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.2474706662.00000000057B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2719758553.0000000000D4B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.2475226109.00000000057B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:17:15
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'285'520 bytes
MD5 hash:	093BDA46F4EBE927A99CC0E120D50D8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2731573576.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.2731573576.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.2581253200.0000000005621000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.2733173056.0000000005624000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:17:23
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'285'520 bytes
MD5 hash:	093BDA46F4EBE927A99CC0E120D50D8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000B.00000003.2632498657.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000B.00000002.2667670233.00000000057AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2666318959.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000B.00000003.2632832669.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000B.00000003.2632657858.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:18:21
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7344 -s 632
Imagebase:	0x750000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:18:21
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7524 -s 1896
Imagebase:	0x750000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:18:22
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1920
Imagebase:	0x750000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:18:29
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 1900
Imagebase:	0x750000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	51.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	43

Executed Functions

Function 004DFF00 Relevance: 98.4, APIs: 50, Strings: 4, Instructions: 3939registrytimefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004E0556
FindNextFileA.KERNEL32(00000000,?), ref: 004E056C
FindClose.KERNEL32(00000000), ref: 004E057C
GetLastError.KERNEL32 ref: 004E0582
GetLastError.KERNEL32 ref: 004E05A0

Part of subcall function 004E71E0: GetCurrentProcess.KERNEL32(004E0900), ref: 004E71EF
Part of subcall function 004E71E0: IsWow64Process.KERNEL32(00000000), ref: 004E71F6

Part of subcall function 0044196B: GetSystemTimeAsFileTime.KERNEL32(004E0A78,00000000,00000000,?,?,?,004E0A78,00000000), ref: 00441980
Part of subcall function 0044196B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044199F

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?,?,?), ref: 004E0D31
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 004E0DFD
RegCloseKey.ADVAPI32(?), ref: 004E0E32
GetCurrentHwProfileA.ADVAPI32(?), ref: 004E0FCA
GetModuleHandleExA.KERNEL32(00000004,004E5FC0,?,?,?,?,?,?,?,?,00000000), ref: 004E14CB
GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,00000000), ref: 004E14E3
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 004E1E96
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 004E1F62
RegCloseKey.ADVAPI32(?), ref: 004E21E1
GetComputerNameA.KERNEL32(?,?), ref: 004E2215
GetUserNameA.ADVAPI32(?,?), ref: 004E23B3
GetDesktopWindow.USER32 ref: 004E2456
GetWindowRect.USER32(00000000,?), ref: 004E2464
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 004E25CF
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 004E2A95
LocalAlloc.KERNEL32(00000040), ref: 004E2AA7
GetKeyboardLayoutList.USER32(?,00000000), ref: 004E2AC2
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 004E2AED
LocalFree.KERNEL32(?), ref: 004E2CB0
GetLocalTime.KERNEL32(?), ref: 004E2CC7
GetSystemTime.KERNEL32(?), ref: 004E2EDD
GetTimeZoneInformation.KERNELBASE(?), ref: 004E2F00
TzSpecificLocalTimeToSystemTime.KERNELBASE(?,?,?), ref: 004E2F25
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 004E333F
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 004E3491
RegCloseKey.ADVAPI32(?), ref: 004E3542
GetSystemInfo.KERNELBASE(?), ref: 004E356A
GlobalMemoryStatusEx.KERNELBASE(?), ref: 004E361D
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004E3731
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 004E3B14
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004E3C53
Process32First.KERNEL32(00000000,?), ref: 004E3C6B
Process32Next.KERNEL32(00000000,?), ref: 004E3C81
Process32Next.KERNEL32(00000000,?), ref: 004E3D53
CloseHandle.KERNEL32(00000000), ref: 004E3D62
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 004E40D6
RegEnumKeyExA.KERNELBASE(?,00000000,?,?), ref: 004E410D
wsprintfA.USER32 ref: 004E41F0
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 004E4213
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 004E4312
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 004E4409
RegCloseKey.ADVAPI32(?), ref: 004E44E5
RegCloseKey.ADVAPI32(?), ref: 004E4500

Strings

;Yb., xrefs: 004E402D
2.0, xrefs: 004E09C7, 004E0A58
lamer, xrefs: 004E0924, 004E09AE
3"A, xrefs: 004DFFC6, 004E0690, 004E0174, 004E0179, 004E0183

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: CloseTime$FileOpenQueryValue$LocalNameSystem$EnumFindNextProcess32$CreateCurrentDevicesDisplayErrorFirstHandleInfoKeyboardLastLayoutListLocaleModuleProcessUserWindow$AllocComputerCopyDefaultDesktopDirectoryFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: 2.0$3"A$;Yb.$lamer
API String ID: 3185416054-4066377185
Opcode ID: 45b43ed7126da009d445b01400a3cc839448738a09c41abf21b3d1ab3094e474
Instruction ID: 762722eee12899a3fad9018c2ab51fc1fd94b4ba954c9d0aaa9e31c72487c533
Opcode Fuzzy Hash: 45b43ed7126da009d445b01400a3cc839448738a09c41abf21b3d1ab3094e474
Instruction Fuzzy Hash: BFB3EFB4D0426D8BDB25CF99C981AEEBBB1FF48300F1041AAD949B7351DB345A81CFA5

Function 0040B8E0 Relevance: 65.9, APIs: 40, Instructions: 5855fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BA08
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BAD2
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040BF80
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040C47A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C575
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040C969
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040CD72
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D17B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040D29A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040D6F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D9DC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040DAD7
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040DE41
CopyFileA.KERNEL32(?,?,00000000), ref: 0040E55A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040ECF6
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040EEEA
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F45B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F525
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 004101ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00410580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0041088D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00410DC4
CopyFileA.KERNEL32(?,?,00000000), ref: 0041173C
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411904
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00411CD7
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411E6E
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411FBE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00410B14

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00410F12
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040FEF1

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040FC55

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F933

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040E6FA

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F

Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0042910D
Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00429155

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040DF3C

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED

CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D5FD

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040BB07

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040BD37
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C0CC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C196

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Directory$Create$File$Copy$Find$Cpp_errorThrow_std::_$AttributesErrorFirstLast$FolderPath___std_fs_convert_narrow_to_wide@20$CloseDeleteNextRemove
String ID:
API String ID: 1172780710-0
Opcode ID: a5ab48d61c2b3dff66acd5580ca9f5a7979e211ebeafd6bfe51893aa718087df
Instruction ID: 57087eddf2f8576e704702d152c9cc5b4e2b87ff67a8e07952ed474be97f1841
Opcode Fuzzy Hash: a5ab48d61c2b3dff66acd5580ca9f5a7979e211ebeafd6bfe51893aa718087df
Instruction Fuzzy Hash: 56F3E2B4D0425D8BDF25CF99C981AEEBBB1BF18304F1041AAD849B7341DB385A85CF69

Function 004AA200 Relevance: 56.8, APIs: 10, Strings: 11, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 004AA277

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F

Strings

Jzv", xrefs: 004BCB48
X<b., xrefs: 004B0396
;Yb., xrefs: 004C47B2
WUa5, xrefs: 004BAC90
;Yb., xrefs: 004BAF18
cannot use operator[] with a string argument with , xrefs: 004B14F5, 004B152D, 004B1580, 004B15B5, 004B15EC, 004B34C2, 004B3500, 004B35B5, 004B83F4, 004B848D, 004BDF6D, 004BE0D4, 004BE129, 004BE17E, 004BE1D9, 004BE22E, 004BE283, 004BE2D8, 004BE32D, 004BE382, 004BFF65, 004BFFA3, 004C0058, 004C1DEA, 004C1E28, 004C1EDD, 004C5EE8, 004C5F20, 004C5FB2
;Yb., xrefs: 004BCCC8
cannot use push_back() with , xrefs: 004B10BB, 004B1333, 004B3367, 004B3558, 004B8296, 004B842E, 004BDFC9, 004BE020, 004BE074, 004BFE23, 004BFFFB, 004C1CD9, 004C1E80, 004C5F5A
;Yb., xrefs: 004B04F0
;Yb., xrefs: 004B62DD
;Yb., xrefs: 004B26EA

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$Jzv"$WUa5$X<b.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-383699475
Opcode ID: c36f79b10380e0d4eb6227b5af65ef75ab6caf6994dd972f376c2d3bc510d359
Instruction ID: d5c29c46e18a526762dbfc7c8aed9f945ae13eab665394adbd88e65e82b678fb
Opcode Fuzzy Hash: c36f79b10380e0d4eb6227b5af65ef75ab6caf6994dd972f376c2d3bc510d359
Instruction Fuzzy Hash: 29B433B0D052698BDB25CF68C984BEEBBB1BF49304F1081DAD449A7281DB746F84CF95

Function 004D7600 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0055B192,000000FF), ref: 004D766C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 004D7693
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7959
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7CBB
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004D8DF7
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 004D9992
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA31E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DA3EF
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA712
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAA7D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DAB4E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAE39
CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 004DB0C9
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB27C
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB556
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB93C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 004DBCF1
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DBEA4
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC17E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC564
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9FB3

Part of subcall function 004DFF00: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004E0556
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E05A0

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC99C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DCAF3

Part of subcall function 004DE430: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DE49D

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9C53

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 004D9648

Part of subcall function 004DFF00: FindNextFileA.KERNEL32(00000000,?), ref: 004E056C
Part of subcall function 004DFF00: FindClose.KERNEL32(00000000), ref: 004E057C
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E0582

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004D91DD

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 004D896A

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 004D8B1D
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004D8362

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 004D8623
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D801B

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID:
API String ID: 1140557632-0
Opcode ID: e82f1e92f549f30e97cc6cc2b299e4ee6cad0568081bbef442e5b3f1a2ecc56a
Instruction ID: 6b404ecdfd53acb60f6cf5d734e717c5294ca690171ae70fa85b8f1a38f34a58
Opcode Fuzzy Hash: e82f1e92f549f30e97cc6cc2b299e4ee6cad0568081bbef442e5b3f1a2ecc56a
Instruction Fuzzy Hash: 76F3F2B4D0525A8BCF15CFA9C9916EEBBB0BF18304F20419AD549B7341DB346B84CFA6

Function 00490440 Relevance: 28.0, APIs: 13, Strings: 2, Instructions: 1749registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?), ref: 0049083B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0049086F
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00490895
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490A2C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490CB3
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490DA0
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490EE1
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490FCB
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 004910B5
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0049119F
RegCloseKey.ADVAPI32(?), ref: 0049229B
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 004922D1
RegCloseKey.ADVAPI32(?), ref: 004922E5

Strings

cannot use operator[] with a string argument with , xrefs: 0049239E, 004923F3
cannot use push_back() with , xrefs: 00492345

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2041898428-3306948993
Opcode ID: d77b9d8c88138d747d633f127853c746ccae4b46e75a2bdc3769da4eb66397e1
Instruction ID: 6d5f253b48c5edfa20594e0b0a8a78ae050bf84d77acb07cc1b8e3b44561805a
Opcode Fuzzy Hash: d77b9d8c88138d747d633f127853c746ccae4b46e75a2bdc3769da4eb66397e1
Instruction Fuzzy Hash: 511322B0C042698BDB25CF68CD84BEEBBB4BF49304F1042EAD549A7241EB756B85CF54

Function 00493F40 Relevance: 26.5, APIs: 12, Strings: 2, Instructions: 1966fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00493FA7

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

FindFirstFileA.KERNEL32(?,?), ref: 0049455F
FindNextFileA.KERNEL32(00000000,?), ref: 0049496C
FindClose.KERNEL32(00000000), ref: 0049497C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00494A53
CreateDirectoryA.KERNEL32(?,00000000), ref: 00494B19
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00494C9D

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 00494E44
CopyFileA.KERNEL32(00000000,?,00000000), ref: 004950F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00495638
CredEnumerateA.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000004), ref: 004959FD
LocalFree.KERNELBASE(00000000,?,?,?,00000004), ref: 004962D7

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,0041ABA8,?,?,?,00431D09,0041ABA8,005799D8,00000000,0041ABA8), ref: 0043525B

Strings

tmX, xrefs: 00493F4D
cannot use operator[] with a string argument with , xrefs: 00496314, 0049636E

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: File$CopyCreateDirectoryFind$Cpp_errorThrow_std::_$AttributesCloseCredEnumerateErrorExceptionFirstFolderFreeLastLocalNextPathRaise
String ID: cannot use operator[] with a string argument with $tmX
API String ID: 3528249430-2011928656
Opcode ID: 3d2b1456e8b39aeb366bde87ef0f14ff4fdcb0ee34f3961ee7aedf5236aca31f
Instruction ID: 1c5c2bc117abc336d538eb0f3ab0e4b698252c7f2e821ac10c87ad1798346723
Opcode Fuzzy Hash: 3d2b1456e8b39aeb366bde87ef0f14ff4fdcb0ee34f3961ee7aedf5236aca31f
Instruction Fuzzy Hash: 0E3310B4C042698BDB25CFA8C994BEDBBB0BF18304F1041EAD849A7351EB346B85CF55

Function 00481C10 Relevance: 21.5, APIs: 7, Strings: 4, Instructions: 2202COMMON

Download Yara Rule

APIs

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 004827AB
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00482AA7
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00482DA5
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00483105
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00483433
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 00483737
Concurrency::cancel_current_task.LIBCPMT ref: 004844E1

Strings

cannot get value, xrefs: 0048445E, 00484598
type must be string, but is , xrefs: 0048455B
cannot compare iterators of different containers, xrefs: 0048449D
type must be boolean, but is , xrefs: 00484507

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: FolderPath$AttributesConcurrency::cancel_current_taskErrorFileLast
String ID: cannot compare iterators of different containers$cannot get value$type must be boolean, but is $type must be string, but is
API String ID: 1974481932-2698695959
Opcode ID: d0301a8b95a08a71e917fed5252be201ad1dde5db3a88a7951cdcef90b627165
Instruction ID: 7d592af2553ac1c7978d8671279e796c0dcb22ab630186640302ddbce1f3b4fb
Opcode Fuzzy Hash: d0301a8b95a08a71e917fed5252be201ad1dde5db3a88a7951cdcef90b627165
Instruction Fuzzy Hash: D74334B0C042698BDB25DF28C994BEEBBB5BF48304F1082DAD449A7281DB756F84CF55

Function 004E6770 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5
SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
DeleteFileA.KERNEL32(?), ref: 004E6AA4
FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
FindClose.KERNEL32(?), ref: 004E6ACA
GetLastError.KERNEL32 ref: 004E6AD0
SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED
RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
GetLastError.KERNEL32 ref: 004E6B20
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Strings

\*.*, xrefs: 004E6834

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: fa9544b1f4525edcf2a18f77abf6cc53c36d2fc4c8b78e4902afa25aa6e8371b
Instruction ID: d809dff945c313677263d2cc5f51936a643c350294cf92fd29307912c56e1fe7
Opcode Fuzzy Hash: fa9544b1f4525edcf2a18f77abf6cc53c36d2fc4c8b78e4902afa25aa6e8371b
Instruction Fuzzy Hash: EDD11670C00288CFDB10DFA9C9487EEBBB1FF65305F20425AE454BB292D7786A89DB55

Function 0049F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049F224
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049F322
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049F515
CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1C76

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1F5D
lstrlen.KERNEL32(?), ref: 004A348E

Strings

~]d, xrefs: 0049FAC6
;Yb., xrefs: 0049FC4C
cannot use operator[] with a string argument with , xrefs: 004A3571, 004A35C6
cannot use push_back() with , xrefs: 004A3518

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $~]d
API String ID: 2833034228-1763774129
Opcode ID: 747f4e010e13d6d04a90195c26ca14158d5fcfd1b6ea7f72e288f8632fb18a75
Instruction ID: 3f98b5ef17dcfaa8f689e4fcb5a5d7fbbd5e2711f2842c60bb6495c93d0a2e70
Opcode Fuzzy Hash: 747f4e010e13d6d04a90195c26ca14158d5fcfd1b6ea7f72e288f8632fb18a75
Instruction Fuzzy Hash: 2793DCB4D052A98ADB65CF29C990BEDBBB1BF59304F0081EAD84DA7241DB742BC4CF45

Function 004963B0 Relevance: 17.5, APIs: 5, Strings: 4, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00496504
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00496602
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 004967F5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498078
lstrlen.KERNEL32(?), ref: 0049854F

Strings

Tz}9, xrefs: 00497260
cannot use operator[] with a string argument with , xrefs: 004985BE, 00498670
;Yb., xrefs: 004974E8
cannot use push_back() with , xrefs: 0049840C, 0049860E

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: ;Yb.$Tz}9$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-4100205650
Opcode ID: 641fc5b18450fd03bf11618a53967572d52a20251f884f0a8a37d384370fa803
Instruction ID: 6b3be8cf9a559e92d133cc3b6572ed682d4dab2050fd03768d9c929fe5be15d2
Opcode Fuzzy Hash: 641fc5b18450fd03bf11618a53967572d52a20251f884f0a8a37d384370fa803
Instruction Fuzzy Hash: 352300B0D052688BDB25CF28C9947EDBBB5BF49304F1082EAE449A7281DB746BC4CF55

Function 004986B0 Relevance: 16.1, APIs: 4, Strings: 4, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00498804
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00498902
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00498AF8
lstrlen.KERNEL32(?), ref: 0049AE11

Strings

AN|5, xrefs: 00499560
cannot use operator[] with a string argument with , xrefs: 0049AE83, 0049AF19
cannot use push_back() with , xrefs: 0049AD31, 0049AEBA
;Yb., xrefs: 0049968E

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$AN|5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-1903585501
Opcode ID: 7a795f4a75cc05358dbe245a654706af840b6884b9ea29fb8d3fe37fdcea0eaf
Instruction ID: e112265f5291f7fbed9e5ebb381307dd27655726dfd0f1f0b2bb5fda635101ca
Opcode Fuzzy Hash: 7a795f4a75cc05358dbe245a654706af840b6884b9ea29fb8d3fe37fdcea0eaf
Instruction Fuzzy Hash: D44322B0D052688BDB25CF28C8947EEBBB5BF49304F1082EAD449A7242DB756BC4CF55

Function 0049AF60 Relevance: 14.1, APIs: 4, Strings: 3, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049B158
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049B265
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049B458
lstrlen.KERNEL32(?), ref: 0049D22D

Strings

;Yb., xrefs: 0049BFEE
cannot use operator[] with a string argument with , xrefs: 0049D29C, 0049D353
cannot use push_back() with , xrefs: 0049D0EA, 0049D2EC

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-747751661
Opcode ID: c3ff6d4c08391f03b95f4eab6d93f624c9091cf10f40d6c6a7f23604d409b1d3
Instruction ID: b2dbe3f5757ef5304a2bca7f4d9e3a7c922558eb406562d1b13ccbd165419304
Opcode Fuzzy Hash: c3ff6d4c08391f03b95f4eab6d93f624c9091cf10f40d6c6a7f23604d409b1d3
Instruction Fuzzy Hash: BF2321B0D042688BDB25CF28C9947EDBBB1BF59304F1082EAE449A7281DB746BC4CF55

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
FreeAddrInfoW.WS2_32(?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
FreeAddrInfoW.WS2_32(?), ref: 004C86A5

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 0049D3A0 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049D4F4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049D5F2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049D7E5
lstrlen.KERNEL32(?), ref: 0049EF32

Strings

cannot use operator[] with a string argument with , xrefs: 0049EF9D, 0049EFDB, 0049F08D
cannot use push_back() with , xrefs: 0049EE76, 0049F02B

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: ae28f5e89c03080d73ac5a78ec42496be91557f4f3b74bbfbf37e3b0e6e5a074
Instruction ID: d38aed82ee4788d52106214de1412b854dd9129e0c255bb6c7140376d04d8967
Opcode Fuzzy Hash: ae28f5e89c03080d73ac5a78ec42496be91557f4f3b74bbfbf37e3b0e6e5a074
Instruction Fuzzy Hash: 570334B0D042688BDB25CF28C9947EEBBB4BF59304F1042EED449A7281EB746B84CF55

Function 004C6D80 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 535
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004C7051

Part of subcall function 00432534: __EH_prolog3.LIBCMT ref: 00432570

std::_Throw_Cpp_error.LIBCPMT ref: 004C7062

Part of subcall function 004E74C0: __fread_nolock.LIBCMT ref: 004E7609

DeleteFileA.KERNELBASE(?), ref: 004C70EB

Strings

lamer, xrefs: 004C7171, 004C718A
131, xrefs: 004C7135, 004C714E

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$lamer
API String ID: 3880692912-2147393740
Opcode ID: ed82176a8a559ef53b8c12fb7edaf71171fa2efdd5e6f73f41023a368e686b71
Instruction ID: 7966019704e3fd473910eda9b3190c6326d4c2da0caac65bea49cbac806563d6
Opcode Fuzzy Hash: ed82176a8a559ef53b8c12fb7edaf71171fa2efdd5e6f73f41023a368e686b71
Instruction Fuzzy Hash: 1E32ACB4D04248CFCB04DFA8C985BAEBBB1BF58304F14419EE8056B392D779AA45CF95

Function 004FAD00 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MATCH, xrefs: 004FB108, 004FB119, 004FB139, 004FB13A, 004FB150
no such vfs: %s, xrefs: 004FAEB7
automatic extension loading failed: %s, xrefs: 004FB22C
sqlite_rename_table, xrefs: 004FB0E4
RTRIM, xrefs: 004FAF68
NOCASE, xrefs: 004FB02A
BINARY, xrefs: 004FAF25, 004FAF34, 004FAF4E, 004FAF8E, 004FAF99, 004FAFB1, 004FB003, 004FB004

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: 709491dc051ea1e70093cc478a2a2d0c63acaf5bae6c4c00e9975ec16f4ae69b
Instruction ID: 5912c9be0b5fe0253428befa1510005b8e6d21b15bd6994098c8da1f87b2af15
Opcode Fuzzy Hash: 709491dc051ea1e70093cc478a2a2d0c63acaf5bae6c4c00e9975ec16f4ae69b
Instruction Fuzzy Hash: 510258B0A007089BEB209F15DC4577B7BE4EF51304F14442EEA4A9B391EBB9E944CBC6

Function 004DF030 Relevance: 8.4, APIs: 5, Instructions: 876
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DF09A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF329

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF52A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF84A

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DFC7D

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID:
API String ID: 2127212259-0
Opcode ID: 0a9d66dacc852727762dd02661486b9ec628ab0a78a4986b9bfafa3a96ef7e23
Instruction ID: 8e27dc709fe3b7ff7b62f4d1f71842afe3ac2492894b6e8ccfd466f18f63ab33
Opcode Fuzzy Hash: 0a9d66dacc852727762dd02661486b9ec628ab0a78a4986b9bfafa3a96ef7e23
Instruction Fuzzy Hash: DBA202B4D0425D8BDF25CFA8C995AEEBBB0BF18304F2041AAD949B7351D7341A84CFA5

Function 004DE430 Relevance: 8.2, APIs: 5, Instructions: 731
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DE49D

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DE8C9
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DEA83
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DED11
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DEE67

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID:
API String ID: 1001086254-0
Opcode ID: 421e36309c22111a033c8f9f38f840648b1e0bb665710f0a707a7c163fba85ac
Instruction ID: 4de69712ac24b7a09e9bc2c7d11d42553b755471a164b72fa8c1d2b7ead1c118
Opcode Fuzzy Hash: 421e36309c22111a033c8f9f38f840648b1e0bb665710f0a707a7c163fba85ac
Instruction Fuzzy Hash: 298225B0C042598BCB15CFA9C995BEEBBB0BF18304F10419ED549BB382DB745A85CFA5

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F
FindNextFileA.KERNELBASE(00000000,00000010), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: f696f36471cce9f3eb40e10dd2f1f3c06691054e1164fa2630a9de22a9a37f80
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: f696f36471cce9f3eb40e10dd2f1f3c06691054e1164fa2630a9de22a9a37f80
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 004C6B00 Relevance: 4.7, APIs: 3, Instructions: 206encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004C6B57
LocalFree.KERNEL32(?), ref: 004C6B86
LocalFree.KERNEL32(?), ref: 004C6C82

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: ca1e730759337fa49bbce61ea0016bf7f681cd111c34800b91b137380e4f608d
Instruction ID: 6019ec204b0dd747d4126109e6a4f8e7bf51aa55734569d67b400ef60c6c0d13
Opcode Fuzzy Hash: ca1e730759337fa49bbce61ea0016bf7f681cd111c34800b91b137380e4f608d
Instruction Fuzzy Hash: 6171B171C002489BDB00DFA8C945BEEFBB4EF14314F10826EE851B3391EB786A44DBA5

Function 0053F550 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053F705
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053FA07

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 7cc4ef92f3a6051046a18418b77ea2a3a6de1ed4712a7747bb821a5c40650b69
Instruction ID: 1f76d2344d35fe0e13097961589cbfb84b6978ae6f877586e2245b879765d82e
Opcode Fuzzy Hash: 7cc4ef92f3a6051046a18418b77ea2a3a6de1ed4712a7747bb821a5c40650b69
Instruction Fuzzy Hash: E3029C71A04702AFDB18CF29C840B6ABBE4BF88318F14867DE859D7650D774ED94CB92

Function 0044002D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b15aa9a463d604c256c669c29f6134746f95fa67f9ccc3a2b131056c85d33937
Instruction ID: 127d1e6b524efbadbaaaff55744b8fab0cc6e196c82b7e7b6ae44d0b7ee8643f
Opcode Fuzzy Hash: b15aa9a463d604c256c669c29f6134746f95fa67f9ccc3a2b131056c85d33937
Instruction Fuzzy Hash: 3BB1F67090060A9BFB28CE68D855ABFBBB1AF04304F140A1FDA52A7791C77D9D21CB59

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000354,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Part of subcall function 004C8590: WSAStartup.WS2_32 ref: 004C85BA
Part of subcall function 004C8590: getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
Part of subcall function 004C8590: socket.WS2_32(?,?,?), ref: 004C865D
Part of subcall function 004C8590: connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
Part of subcall function 004C8590: closesocket.WS2_32(00000000), ref: 004C867D
Part of subcall function 004C8590: FreeAddrInfoW.WS2_32(?), ref: 004C868A
Part of subcall function 004C8590: WSACleanup.WS2_32 ref: 004C8690

recv.WS2_32(?,00000004,00000008), ref: 004C7E23
__Xtime_get_ticks.LIBCPMT ref: 004C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004C7EB9

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: f9e28bc168eabd23f713c9d075067e09dfc649ed2f0dd86ee053ab152bb4c171
Instruction ID: b3d54dcccad81d83ab75f13ba9899d4b50e1d8608cabcccfb3508871926cac68
Opcode Fuzzy Hash: f9e28bc168eabd23f713c9d075067e09dfc649ed2f0dd86ee053ab152bb4c171
Instruction Fuzzy Hash: 9EB1AC71D043089BEB10DBA8CC49BAEBBB1BB54314F24025EE815BB2D2D7785D88DF95

Function 0045E140 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045E3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045E4C6
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0045E808
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045EB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045EC10

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045ED06

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045EDED
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045F06D

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: e1ed7e54ebd5b020c8e79904b3ae03e0818e29e9e47e40a3245b38651c09fec3
Instruction ID: 0e418cf523baa0a35c0a910b93c4bb77d5942d6061cfe1063ad62b245a56bb8b
Opcode Fuzzy Hash: e1ed7e54ebd5b020c8e79904b3ae03e0818e29e9e47e40a3245b38651c09fec3
Instruction Fuzzy Hash: 4FA226B0D012688BCB25DB65CD95BDDBBB4AF14304F0040EED44A67282EB785F88DF5A

Function 004E4720 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 004E4A70
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 004E4ADC
LsaOpenPolicy.ADVAPI32(00000000,00587684,00000001,?), ref: 004E4B35
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 004E4B48
LsaFreeMemory.ADVAPI32(?), ref: 004E4B76
LsaClose.ADVAPI32(?), ref: 004E4B7F

Strings

&"N, xrefs: 004E472D
%wZ, xrefs: 004E4B65
;Yb., xrefs: 004E49C7

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$&"N$;Yb.
API String ID: 762890658-4094109456
Opcode ID: 71ef275a8d6462c4c5fc6e537bb68741ac7498f384360e828531ccc0aa0ebddd
Instruction ID: db120a3af714b361d6db134a28a940fef9e0d4b71911d12d67c4190411436b99
Opcode Fuzzy Hash: 71ef275a8d6462c4c5fc6e537bb68741ac7498f384360e828531ccc0aa0ebddd
Instruction Fuzzy Hash: 1EE101B4D0425A8FDB14CF98C985BEEBBB4BF08304F2041AAE949B7341D7745A85CFA5

Function 00448910 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943b4daea694f09bf5cc7279e1323805ab79d8a6de6c46f62910db13226954fd
Instruction ID: d4d7462daa34083545f9d93f0c5ebf53bf58a01a885379ada905c47cec286c1a
Opcode Fuzzy Hash: 943b4daea694f09bf5cc7279e1323805ab79d8a6de6c46f62910db13226954fd
Instruction Fuzzy Hash: E2B1F4B0A00245AFFB11DF99C881BAE7BB1FF55304F14015EE414AB392CB78AD81CB69

Function 004D6BA0 Relevance: 9.2, APIs: 6, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
6CE47CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50
SetLastError.KERNEL32(00000000), ref: 004D6CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D25
GetLastError.KERNEL32(?,?,00000000), ref: 004D6D33
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D47

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: ErrorLast$CopyFile
String ID:
API String ID: 936320341-0
Opcode ID: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction ID: cca443e56f4e81c83c2dc89493b37bcb85ee1d7da0cfa031959f485395bd6110
Opcode Fuzzy Hash: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction Fuzzy Hash: 6051C172D01219ABCB21CF94DC55BEEBBB8EB04320F10026AE804B3390D7396E05CBA4

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: f134e1088910f21205feb50cafa7421b375cc3c6533d6feb8916e2264968fd77
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: f134e1088910f21205feb50cafa7421b375cc3c6533d6feb8916e2264968fd77
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 00463830 Relevance: 6.9, APIs: 3, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6C10: CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004E6C55

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00465CB0
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00465FD5

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00465EC6

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 05a502395d9f526f757c14469c863ff3b4cefea8d5e99dd5fdd399119d475625
Instruction ID: bdb7de5e538d98cc2bc1e856d074b668cb5d4ba5ca64421d2565693f44b24664
Opcode Fuzzy Hash: 05a502395d9f526f757c14469c863ff3b4cefea8d5e99dd5fdd399119d475625
Instruction Fuzzy Hash: 8053CFB0D052688FDB65DF55C994BDDBBB0BB58304F0041EAD44AA7292EB382F84DF49

Function 004E6CA0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 65662f257d92aefc3507c5f8cb9ddc555297535a90f0ce1970463870aaf9e219
Instruction ID: 241e2f942859b358e1133ab4bf22632851a161ac9c5554c12c2f2fb0b7350d8e
Opcode Fuzzy Hash: 65662f257d92aefc3507c5f8cb9ddc555297535a90f0ce1970463870aaf9e219
Instruction Fuzzy Hash: DF11CE71A0028496DB205F6A5C08F6A7F60EB22772F64031BD8359B3D4DB3948058759

Function 004D6790 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 004D6A20

Part of subcall function 004D6BA0: GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
Part of subcall function 004D6BA0: 6CE47CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50

std::_Throw_Cpp_error.LIBCPMT ref: 004D6B84
std::_Throw_Cpp_error.LIBCPMT ref: 004D6B95

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyErrorFileLast
String ID:
API String ID: 1723067277-0
Opcode ID: e483eb5b337a640106d2fd647702f1d046535e5974e3c1cb80ba773399d43a59
Instruction ID: af59b977606615079acd7a310a8afa41bd250120d803ccb4a837ad8b48953fd5
Opcode Fuzzy Hash: e483eb5b337a640106d2fd647702f1d046535e5974e3c1cb80ba773399d43a59
Instruction Fuzzy Hash: 5BD18BB0C00249DBDB04DFA9C9557EEBBB1BF54304F14419ED80577382EB785A45CBA6

Function 00493B60 Relevance: 4.8, APIs: 3, Instructions: 264registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 00493D89
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?), ref: 00493DAC
RegCloseKey.ADVAPI32(?), ref: 00493DB7

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 77d91e2ffbc41f4e718118182c7f4e60994b52f51d4fd49462c42fe523481256
Instruction ID: c2861601c7c989816088ca7cd521e7ac3defefe444e22908af63c5fcea44e6b0
Opcode Fuzzy Hash: 77d91e2ffbc41f4e718118182c7f4e60994b52f51d4fd49462c42fe523481256
Instruction Fuzzy Hash: C8C136B1D042499FDB14CFA8D986BAEBBB0EF09314F204169E905B7391E7345A84CFA5

Function 004E6C10 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004E6C55

Part of subcall function 00432BAA: RtlReleaseSRWLockExclusive.NTDLL(004E6D30), ref: 00432BBE

std::_Throw_Cpp_error.LIBCPMT ref: 004E6C84
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C95

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 1369faf54573f1097b34743c1b99fafbb3d15d6b7359fe2f2678d7eae3eda35f
Instruction ID: b54f6e02dbe68d52aaf8ce57ceccae370b453a77f91dfdb3bbc81736346272f4
Opcode Fuzzy Hash: 1369faf54573f1097b34743c1b99fafbb3d15d6b7359fe2f2678d7eae3eda35f
Instruction Fuzzy Hash: B2F049B1500640FBD7109F999D06B6ABBA8FB05731F14031AFC35A63D0D7B5190087AA

Function 0044B9D0 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,0043D2B1,?), ref: 0044B9D8
GetLastError.KERNEL32(?,0043D2B1,?), ref: 0044B9E2
__dosmaperr.LIBCMT ref: 0044B9E9

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 09b3d7d03d43d7566e94fc4839c3f2f0e9d57db1a11ed26f70a1bc8201ac59e9
Instruction ID: 29a5b21677c8caf908dcad016bfb5ae84cbfd6cad116b975ceede8be2d8f2443
Opcode Fuzzy Hash: 09b3d7d03d43d7566e94fc4839c3f2f0e9d57db1a11ed26f70a1bc8201ac59e9
Instruction Fuzzy Hash: 00D0C9321146086BEA106BB6BC089163B6D9A913797140616F52CC52A0EE25C895A665

Function 004E57F0 Relevance: 3.4, APIs: 2, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004E588F
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004E5B9B

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: 0a0dcd09eef47cc32d5847b2942677d40245ae2126d3bdebcd0edae20a9bad6e
Instruction ID: 009fea26e280c08ebde66711631a2368a09a7ac58c7b38572a32fddf838a6e16
Opcode Fuzzy Hash: 0a0dcd09eef47cc32d5847b2942677d40245ae2126d3bdebcd0edae20a9bad6e
Instruction Fuzzy Hash: 81F157B0D002499BDB14CFA8C9957EEBBB1FF08304F24425EE545BB381DB756A84CBA5

Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00448E9F: GetConsoleOutputCP.KERNEL32(6E40838E,00000000,00000000,0043D0C7), ref: 00448F02

WriteFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,?,004E6E3C,?,0043CFE7,004E6E3C,?,00579E10,00000010,0043D0C7), ref: 0044990E
GetLastError.KERNEL32(?,0043CFE7,004E6E3C,?,00579E10,00000010,0043D0C7,004E6E3C,?,00000000,?), ref: 00449918

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 31457cb41688bf9267a4d34aaba0591c787e78cc82baf2098e7bb743f7a0da0b
Instruction ID: 4c198159cf300fc4e9085a349e24ad4d45033eb13303bb4f9288eddf9455663d
Opcode Fuzzy Hash: 31457cb41688bf9267a4d34aaba0591c787e78cc82baf2098e7bb743f7a0da0b
Instruction Fuzzy Hash: 9961C5B1C14119BFEF11DFA8C844AAFBBB9AF49304F14014AE800A7316D739DD05EB65

Function 004D65F0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D676A
std::_Throw_Cpp_error.LIBCPMT ref: 004D677B

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: ee00d86a89ee62715d60b896044e90f690cda42d917c0ef1e64fc9d0a964cb8a
Instruction ID: 177bb7d1701b8dda1f5a90c4ee3be826f8175b366ab48e47effb054e9b4aa952
Opcode Fuzzy Hash: ee00d86a89ee62715d60b896044e90f690cda42d917c0ef1e64fc9d0a964cb8a
Instruction Fuzzy Hash: 6441F2B1E002058BC720DF68995136EBBA1BB94314F19072FE815673D1EB79EA04C795

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E5F

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,0043D0C7,00000000,00000002,00000000,00000000,00000000,00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000), ref: 00442558
GetLastError.KERNEL32(00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000,?,0044982E,00000000,00000000,00000000,00000002,0043D0C7,00000000), ref: 00442565

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 0044B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B030
GetLastError.KERNEL32(?,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B03B

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction ID: f233056e1464041c82b2d36bf1c88bdb576215b3e64377b8de55bab97aefa9e3
Opcode Fuzzy Hash: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction Fuzzy Hash: 66E08C32100204ABEB212FA5AC0CB9A3B69EF00756F15802AF608971B0DB38C894D798

Function 00415350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0041546E

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: b9807a8e1e53bdc0741c0b29a15e753e918fcacc6ab5bfcc201a1d379d2a7090
Instruction ID: bd448271620100f3a1b1b6e8090fbb17c8ec551eb96fe3ea9a7077eb077db61a
Opcode Fuzzy Hash: b9807a8e1e53bdc0741c0b29a15e753e918fcacc6ab5bfcc201a1d379d2a7090
Instruction Fuzzy Hash: AF6199B1A00614DFCB10CF59C984B9ABBF5FF88310F24816EE8199B391C778EA41CB95

Function 00438E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0750673b6008633cc79045623eaeb207d83782e0e9d8302f40567207ba640ce
Instruction ID: 9663080612542d3e5f9b84a36c3ecf1ef98ea00319430370267f097460dfd66c
Opcode Fuzzy Hash: e0750673b6008633cc79045623eaeb207d83782e0e9d8302f40567207ba640ce
Instruction Fuzzy Hash: 2651C670A00204AFDF14DF59C881AAABBA2EF8D328F24915EF8089B352D775DD41CB55

Function 00429E20 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00429F7B

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8482c0d6c957f33918d9138d1bd6797b8604ed2ab317032aa5cc83da2685a5d5
Instruction ID: efe4cd6a287aa12a83b409d23e88dd93d6c4865ddef84cf0d949cd52fc0f7608
Opcode Fuzzy Hash: 8482c0d6c957f33918d9138d1bd6797b8604ed2ab317032aa5cc83da2685a5d5
Instruction Fuzzy Hash: AA410271E001259FCB14DF68C9419AEBBB9EB89310F64422EE815E7381D738DE01CBE4

Function 004E7640 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E77AC

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 025cbb467e96eb611f2940d14225f23d526d4ccfef296c2d3f6c21a772ab55fe
Instruction ID: 028c77ef4637c0ac0bfd58be9ca2c186fed01019b569c5d695070078eed700b9
Opcode Fuzzy Hash: 025cbb467e96eb611f2940d14225f23d526d4ccfef296c2d3f6c21a772ab55fe
Instruction Fuzzy Hash: A8517FB0D043499BDB10DF99D986BAEFBB4FF44714F10012EE8416B381D7796A44CBA5

Function 004E74C0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E7609

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 630099f540daf6efa67ea676e65f3a2a0d7fe5641c6b0820276aea293422c398
Instruction ID: 959dba962c579710b3c8227977385e6342f185642bc3a86ace1f34c607c4467c
Opcode Fuzzy Hash: 630099f540daf6efa67ea676e65f3a2a0d7fe5641c6b0820276aea293422c398
Instruction Fuzzy Hash: 78416CB0D04248EBDB14DF99D985BEEBBB4FF48714F10416EE801AB381D7799901CBA5

Function 00406870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00406908

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: c3b8b3600ed0ad07f9a4110fed077291c3700e835e34d0cb827fcc3074b6ad22
Instruction ID: 382a6ddcba4688358f9e0a4ad0208e6a3358ad319658d54a7c18dfc33c73484c
Opcode Fuzzy Hash: c3b8b3600ed0ad07f9a4110fed077291c3700e835e34d0cb827fcc3074b6ad22
Instruction Fuzzy Hash: AB21AE76E00619ABCB14EF49D841BAAB7B4FB84324F00466EED1663780DB396D10CB94

Function 004E5D00 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(0055D560,00000000,00000000), ref: 004E5D47

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction ID: 3af1858aaf6aa964ebdd9f4359c5c99147492c850a3065a18f0c0dee6211d041
Opcode Fuzzy Hash: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction Fuzzy Hash: A0110EB1D04B449BE3208F28DD0A757BBF0EB00B28F10471EE850573C1E3BA6A4887E2

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 00406840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406853

Part of subcall function 00431F7B: FindNextFileW.KERNELBASE(?,?,?,00406858,?,?,?,?,0040691A,?,?,?,00000000,?,?), ref: 00431F84

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction ID: f155dccb83496c4d8f98fbb14974b26749813e83e467fdfa34ea523ab42003ff
Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction Fuzzy Hash: 63D05E22701520118D24752738085AF06498DC66A8A42447FB84AB32C2EA2D8C0311AD

Function 004466D5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004466DC

Memory Dump Source

Source File: 00000000.00000002.2688779198.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2688649707.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688940387.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2688980812.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689013674.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689049517.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000729000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689081534.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2689681140.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_D44CPdpkNk.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction ID: ccf5b3b5ee64302dd7184922bc8d264c22512182c10063c293431932d1ea205a
Opcode Fuzzy Hash: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction Fuzzy Hash: 13E09AB2C0020D9ADB00DFD5C452BEFBBB8AB08315F50446BA205E6181EB789748CBE5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report D44CPdpkNk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_D44CPdpkNk.exe_ca452f225a5bfbfa4899462b03597b9e382c87a_da5453f1_eb289314-d05a-4b54-8b62-645a63860303\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_2699415f5fdb1b8726d39a1517f1ac2e93897fae_f4fd270f_91cbe5a9-858b-41b9-933d-561fbdab6283\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_2699415f5fdb1b8726d39a1517f1ac2e93897fae_f4fd270f_cbd5ed6f-f1b1-46e2-ae61-8477867d2156\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_7c9841f9f13651f5ded4f2d68b2cd516a5a13a6c_2a26eb84_b7177fe9-08e6-4125-bc00-27f903d61e18\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER494.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER541.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER59F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8A0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE97A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAE2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB9E.tmp.WERInternalMetadata.xml

Windows Analysis Report
D44CPdpkNk.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre