Edit tour

Windows Analysis Report
PNO3otPYOa.exe

Overview

General Information

Sample name:	PNO3otPYOa.exe renamed because original name is a hash value
Original sample name:	ffccf1df9e560e259284b35348a3989f.exe
Analysis ID:	1460309
MD5:	ffccf1df9e560e259284b35348a3989f
SHA1:	853ad3befc8423ebd10442fc1fd3d436b3656afa
SHA256:	e2de3f42bd8737b0b825370aa662cf700b88a05832e4c26a3c7d8a3579b03227
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PNO3otPYOa.exe (PID: 3168 cmdline: "C:\Users\user\Desktop\PNO3otPYOa.exe" MD5: FFCCF1DF9E560E259284B35348A3989F)

schtasks.exe (PID: 6520 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5836 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 5636 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 1972 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 2668 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: FFCCF1DF9E560E259284B35348A3989F)

WerFault.exe (PID: 5136 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 1916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 2272 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: FFCCF1DF9E560E259284B35348A3989F)

WerFault.exe (PID: 1988 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1736 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 4956 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: FFCCF1DF9E560E259284B35348A3989F)

RageMP131.exe (PID: 4440 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: FFCCF1DF9E560E259284B35348A3989F)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\J7z8s88sXcCE6j1G9cCUUTi.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\r_sRxMygZ5JYHZAcFpnL_Yd.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2840550495.00000000057C0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.2823886060.00000000057C0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2855619080.00000000057C6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.2619633459.00000000057C6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PNO3otPYOa.exe PID: 3168	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 2668	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 2668	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 2272	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 2272	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 4956	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 4440	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\PNO3otPYOa.exe, ProcessId: 3168, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-19:37:42.593714
SID:	2046269
Source Port:	49707
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:37:22.677810
SID:	2046266
Source Port:	58709
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-19:37:42.406359
SID:	2046269
Source Port:	49706
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:38:03.935564
SID:	2046267
Source Port:	58709
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-19:37:57.156294
SID:	2046269
Source Port:	49717
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:37:15.832806
SID:	2046266
Source Port:	58709
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-19:37:50.390622
SID:	2046269
Source Port:	49710
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-19:37:01.301696
SID:	2049060
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:37:47.877509
SID:	2046267
Source Port:	58709
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-19:37:36.375060
SID:	2046269
Source Port:	49705
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:37:47.713249
SID:	2046267
Source Port:	58709
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:37:47.917742
SID:	2046267
Source Port:	58709
Destination Port:	49707
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:37:01.927137
SID:	2046266
Source Port:	58709
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:37:07.981504
SID:	2046266
Source Port:	58709
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:37:08.081416
SID:	2046266
Source Port:	58709
Destination Port:	49707
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://77.91.77.81/mine/amadka.exe	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exe	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exen	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe/risepro	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exeh	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe00.1	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exerracoi$	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: PNO3otPYOa.exe

ReversingLabs: Detection: 54%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PNO3otPYOa.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_004C6B00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		6_2_004C6B00

Source: PNO3otPYOa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_00493F40
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004938D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	6_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	6_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	6_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	6_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_004938D0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49705 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49705 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49707
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49706 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49707 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49710
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49710 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.5:49717
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49717 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.5:49707
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.5:49717

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 77.91.77.66 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 77.91.77.66:58709

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15
Source: Joe Sandbox View	IP Address: 77.91.77.66 77.91.77.66

Source: Joe Sandbox View

ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Code function: 0_2_004C8590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,FreeAddrInfoW,WSACleanup,FreeAddrInfoW,

0_2_004C8590

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exen
Source: PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe/risepro
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe00.1
Source: PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exerracoi$
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe
Source: PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exeh
Source: Amcache.hve.16.dr	String found in binary or memory: http://upx.sf.net
Source: PNO3otPYOa.exe, 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmp, PNO3otPYOa.exe, 00000000.00000003.2023432722.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2835935957.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2083193308.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2821306165.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2084187915.00000000028C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2749828404.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2165267286.0000000002890000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2245506050.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2750366653.000000000055D000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/PS
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/Z
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33?2
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33s
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/~
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/~OM
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.3352
Source: PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000F9F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F16000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/SE
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/T
Source: PNO3otPYOa.exe, 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmp, PNO3otPYOa.exe, 00000000.00000003.2023432722.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2835935957.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2083193308.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2821306165.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2084187915.00000000028C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2749828404.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2165267286.0000000002890000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2245506050.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2750366653.000000000055D000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/k
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/uQX
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33?
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33B
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33OV
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33o
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33x
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F16000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33G
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33r
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.7
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057C6000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2840550495.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2823886060.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, J7z8s88sXcCE6j1G9cCUUTi.zip.6.dr, r_sRxMygZ5JYHZAcFpnL_Yd.zip.0.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT;
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTF
Source: MPGPH131.exe, 00000006.00000002.2840550495.00000000057C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTJ9U
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTp;
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTted88
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr, passwords.txt.6.dr	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.46.123.33b
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot2
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botDU
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botL
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botY
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bots
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.zx
Source: PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: PNO3otPYOa.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: PNO3otPYOa.exe, 00000000.00000003.2610854014.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2604694117.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2605775440.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2603602544.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596911417.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2592530864.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2618678401.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2651907976.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2594138136.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2601645989.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2615048675.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2619040137.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2613206614.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2840729994.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2618150729.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2617064829.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2616066299.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2595194273.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2616427478.0000000005812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/y
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: PNO3otPYOa.exe, 00000000.00000003.2610854014.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2604694117.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2605775440.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2603602544.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596911417.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2592530864.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2618678401.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2651907976.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2594138136.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2601645989.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2615048675.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2619040137.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2613206614.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2840729994.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2618150729.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2617064829.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2616066299.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2595194273.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2616427478.0000000005812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/7)_1
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ata
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/
Source: PNO3otPYOa.exe, 00000000.00000003.2610854014.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2604694117.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2605775440.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2603602544.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596911417.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2592530864.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2618678401.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2651907976.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2594138136.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2601645989.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2615048675.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2619040137.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2613206614.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2840729994.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2618150729.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2617064829.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2616066299.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2595194273.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2616427478.0000000005812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/irefoxz
Source: PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Code function: 0_2_004E5FF0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,73BC74A0,DeleteObject,DeleteObject,ReleaseDC,

0_2_004E5FF0

System Summary

PE file contains section with special chars

Source: PNO3otPYOa.exe	Static PE information: section name:
Source: PNO3otPYOa.exe	Static PE information: section name:
Source: PNO3otPYOa.exe	Static PE information: section name:
Source: PNO3otPYOa.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0044002D	0_2_0044002D
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004DF030	0_2_004DF030
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0049F0D0	0_2_0049F0D0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004AA200	0_2_004AA200
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0049D3A0	0_2_0049D3A0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004963B0	0_2_004963B0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00490440	0_2_00490440
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004DE430	0_2_004DE430
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0053F550	0_2_0053F550
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004D7600	0_2_004D7600
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004986B0	0_2_004986B0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0040B8E0	0_2_0040B8E0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00481C10	0_2_00481C10
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004FAD00	0_2_004FAD00
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00493F40	0_2_00493F40
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0049AF60	0_2_0049AF60
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004DFF00	0_2_004DFF00
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00493080	0_2_00493080
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004371A0	0_2_004371A0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0044036F	0_2_0044036F
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004A4320	0_2_004A4320
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004845E0	0_2_004845E0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0042F580	0_2_0042F580
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004A3610	0_2_004A3610
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_005486C0	0_2_005486C0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00547760	0_2_00547760
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004E77E0	0_2_004E77E0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004547BF	0_2_004547BF
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0043C960	0_2_0043C960
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0043A928	0_2_0043A928
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0044DA86	0_2_0044DA86
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00458BB0	0_2_00458BB0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004EEC40	0_2_004EEC40
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004EFC40	0_2_004EFC40
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00534D40	0_2_00534D40
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00546D20	0_2_00546D20
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00545DE0	0_2_00545DE0
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00458E30	0_2_00458E30
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00541F00	0_2_00541F00
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004F2FD0	0_2_004F2FD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0044002D	6_2_0044002D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004DF030	6_2_004DF030
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0049F0D0	6_2_0049F0D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004AA200	6_2_004AA200
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0049D3A0	6_2_0049D3A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004963B0	6_2_004963B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00490440	6_2_00490440
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004DE430	6_2_004DE430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0053F550	6_2_0053F550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004D7600	6_2_004D7600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004986B0	6_2_004986B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0040B8E0	6_2_0040B8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00481C10	6_2_00481C10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004FAD00	6_2_004FAD00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00493F40	6_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0049AF60	6_2_0049AF60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004DFF00	6_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00493080	6_2_00493080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004371A0	6_2_004371A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0044036F	6_2_0044036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004A4320	6_2_004A4320
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004845E0	6_2_004845E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0042F580	6_2_0042F580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004A3610	6_2_004A3610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005486C0	6_2_005486C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00547760	6_2_00547760
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004E77E0	6_2_004E77E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004547BF	6_2_004547BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0043C960	6_2_0043C960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0043A928	6_2_0043A928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0044DA86	6_2_0044DA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00458BB0	6_2_00458BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004EEC40	6_2_004EEC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004EFC40	6_2_004EFC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00534D40	6_2_00534D40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00546D20	6_2_00546D20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00545DE0	6_2_00545DE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00458E30	6_2_00458E30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00541F00	6_2_00541F00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004F2FD0	6_2_004F2FD0

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0041ACE0 appears 86 times
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: String function: 0041ACE0 appears 86 times

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 1972

Source: PNO3otPYOa.exe	Binary or memory string: OriginalFilename vs PNO3otPYOa.exe
Source: PNO3otPYOa.exe, 00000000.00000000.2020714356.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs PNO3otPYOa.exe
Source: PNO3otPYOa.exe, 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs PNO3otPYOa.exe
Source: PNO3otPYOa.exe	Binary or memory string: OriginalFilenamedotnet.exe6 vs PNO3otPYOa.exe

Source: PNO3otPYOa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PNO3otPYOa.exe	Static PE information: Section: ZLIB complexity 0.99894497066428
Source: PNO3otPYOa.exe	Static PE information: Section: ZLIB complexity 0.9942434210526315
Source: PNO3otPYOa.exe	Static PE information: Section: ZLIB complexity 0.99072265625
Source: PNO3otPYOa.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99894497066428
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9942434210526315
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99072265625
Source: RageMP131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99894497066428
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9942434210526315
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99072265625
Source: MPGPH131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@14/62@3/3

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_004DFF00

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2272
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1412:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2668
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1716:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3168

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PNO3otPYOa.exe, 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmp, PNO3otPYOa.exe, 00000000.00000003.2023432722.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2835935957.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2083193308.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2821306165.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2084187915.00000000028C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2749828404.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2165267286.0000000002890000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2245506050.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2750366653.000000000055D000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: PNO3otPYOa.exe, 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmp, PNO3otPYOa.exe, 00000000.00000003.2023432722.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2835935957.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2083193308.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2821306165.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2084187915.00000000028C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2749828404.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2165267286.0000000002890000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2245506050.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2750366653.000000000055D000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: PNO3otPYOa.exe, 00000000.00000003.2610474711.000000000581C000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000003.2611164355.0000000005809000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2594074973.0000000005818000.00000004.00000020.00020000.00000000.sdmp, b4ep9YrEJBiwLogin Data.0.dr, YWghbxCAFBJrLogin Data.6.dr, JPQQEN02i61OLogin Data.0.dr, GK7TDaUZmBPNLogin Data For Account.6.dr, b81p5RNJHBPPLogin Data.6.dr, tMEkdeo4FFLNLogin Data For Account.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PNO3otPYOa.exe

ReversingLabs: Detection: 54%

Source: PNO3otPYOa.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

File read: C:\Users\user\Desktop\PNO3otPYOa.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PNO3otPYOa.exe "C:\Users\user\Desktop\PNO3otPYOa.exe"
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 1972
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 1916
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1736
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PNO3otPYOa.exe

Static file information: File size 3423760 > 1048576

Source: PNO3otPYOa.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x28c600

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_004CF280

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: PNO3otPYOa.exe	Static PE information: section name:
Source: PNO3otPYOa.exe	Static PE information: section name:
Source: PNO3otPYOa.exe	Static PE information: section name:
Source: PNO3otPYOa.exe	Static PE information: section name:
Source: PNO3otPYOa.exe	Static PE information: section name: .themida
Source: PNO3otPYOa.exe	Static PE information: section name: .boot
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .themida
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .themida
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00433F59 push ecx; ret	0_2_00433F6C
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_005F6FA2 push ecx; mov dword ptr [esp], 33711A4Ah	0_2_008B6662
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00433F59 push ecx; ret	6_2_00433F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_005F6FA2 push ecx; mov dword ptr [esp], 33711A4Ah	6_2_008B6662

Source: PNO3otPYOa.exe	Static PE information: section name: entropy: 7.9829541104019395
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.9829541104019395
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.9829541104019395

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Stalling execution: Execution stalls by calling Sleep

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Window / User API: threadDelayed 419	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 444
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 353

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-53262

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-53377

Source: C:\Users\user\Desktop\PNO3otPYOa.exe TID: 5068	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe TID: 5068	Thread sleep count: 419 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe TID: 5068	Thread sleep time: -42319s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5032	Thread sleep count: 348 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5032	Thread sleep time: -35148s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3364	Thread sleep count: 347 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3364	Thread sleep time: -35047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1216	Thread sleep count: 60 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1216	Thread sleep count: 444 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1216	Thread sleep time: -44844s >= -30000s
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 3748	Thread sleep count: 353 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 3748	Thread sleep time: -35653s >= -30000s

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_00493F40
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004938D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	6_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	6_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	6_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	6_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	6_2_004938D0

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

0_2_004DFF00

Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: formVMware20,11696428655
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ccount.microsoft.com/profileVMware20,11696428655u
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT service, encrypted_token FROM token_servicerr global passwords blocklistVMware20,11696428655
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696
Source: MPGPH131.exe, 00000006.00000003.2614381832.000000000582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,11696428
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r global passwords blocklistVMware20,11696428655
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHk
Source: PNO3otPYOa.exe, 00000000.00000003.2611676678.0000000005818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696428655
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: PNO3otPYOa.exe, 00000000.00000003.2617256419.000000000581E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.16.dr	Binary or memory string: vmci.sys
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: MPGPH131.exe, 00000006.00000003.2614381832.000000000582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ebrokers.co.inVMware20,11696428655d
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4468A0FF
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4468A0FFFk21
Source: Amcache.hve.16.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: PNO3otPYOa.exe, 00000000.00000003.2611676678.0000000005818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT name, value FROM autofillmain'.sqlite_masterr global passwords blocklistVMware20,11696428655
Source: Amcache.hve.16.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.16.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@J
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual USB Mouse
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: RageMP131.exe, 0000000A.00000003.2280024617.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000006.00000003.2614381832.000000000582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116
Source: Amcache.hve.16.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Amcache.hve.16.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rootpagecomVMware20,11696428655o
Source: MPGPH131.exe, 00000006.00000003.2614381832.000000000582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s.portal.azure.comVMware20,11696428655
Source: Amcache.hve.16.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.16.dr	Binary or memory string: vmci.syshbin`
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: PNO3otPYOa.exe, 00000000.00000003.2070484836.0000000000F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}$
Source: Amcache.hve.16.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pageformVMware20,11696428655
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: MPGPH131.exe, 00000006.00000003.2614381832.000000000582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696(
Source: MPGPH131.exe, 00000007.00000002.2824312294.0000000005C20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}FilesPSModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: MPGPH131.exe, 00000006.00000003.2614381832.000000000582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: billing_address_id.comVMware20,11696428
Source: Amcache.hve.16.dr	Binary or memory string: VMware
Source: MPGPH131.exe, 00000007.00000003.2132480957.0000000000E28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#3
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@
Source: MPGPH131.exe, 00000006.00000003.2614381832.000000000582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .utiitsl.comVMware20,1169642865
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.16.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F16000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RageMP131.exe, 0000000A.00000003.2280024617.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: PNO3otPYOa.exe, 00000000.00000003.2611676678.0000000005818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eVMware20,11696428655
Source: Amcache.hve.16.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169642865
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RageMP131.exe, 00000008.00000002.2751365986.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AESCPI\DSDT\VBOX__Virt
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: MPGPH131.exe, 00000006.00000003.2614381832.000000000582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nickname.utiitsl.comVMware20,1169642865
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.16.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.16.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: MPGPH131.exe, 00000006.00000003.2614381832.000000000582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra Change Transaction PasswordVMware20,11696428655
Source: Amcache.hve.16.dr	Binary or memory string: VMware VMCI Bus Device
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o.inVMware20,11696428655~
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.16.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&5
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4468A0FFT`
Source: Amcache.hve.16.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.16.dr	Binary or memory string: VMware, Inc.
Source: PNO3otPYOa.exe, 00000000.00000003.2611676678.0000000005818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428657
Source: Amcache.hve.16.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.16.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696428655
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.16.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}g,u.eg,v.eg,w.eg,x.eg,y.eg,z.eg,a.in,b.in,c.in,d.in,e.in,f.in,g.in,h.in,i.in,j.in,k.in,l.in,m.in,n.in,o.in
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}vgE
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: comVMware20,11696428655o
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.16.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: G6hWgD726jZgWeb Data.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.16.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: PNO3otPYOa.exe, 00000000.00000003.2615940466.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tive Brokers - non-EU EuropeVMware20,11696428655
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}g,u.ug,v.ug,w.ug,x.ug,y.ug,z.ug,a.sy,b.sy,c.sy,d.sy,e.sy,f.sy,g.sy,h.sy,i.sy,j.sy,k.sy,l.sy,m.sy,n.sy,o.sy
Source: RageMP131.exe, 0000000A.00000002.2752487929.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3)
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF
Source: Amcache.hve.16.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4468A0FF
Source: PNO3otPYOa.exe, 00000000.00000003.2611676678.0000000005818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696x.

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00438A64

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

0_2_004CF280

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004C6D80 mov eax, dword ptr fs:[00000030h]	0_2_004C6D80
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00493F40 mov eax, dword ptr fs:[00000030h]	0_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004C6D80 mov eax, dword ptr fs:[00000030h]	6_2_004C6D80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00493F40 mov eax, dword ptr fs:[00000030h]	6_2_00493F40

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Code function: 0_2_004E9A70 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

0_2_004E9A70

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043451D
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00438A64
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0043451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00438A64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_004CF280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 6_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		6_2_004CF280

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: GetLocaleInfoW,	0_2_004531CA
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: EnumSystemLocalesW,	0_2_0044B1B1
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004532F3
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: GetLocaleInfoW,	0_2_004533F9
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004534CF
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: GetLocaleInfoW,	0_2_0044B734
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00452B5A
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: GetLocaleInfoW,	0_2_00452D5F
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: EnumSystemLocalesW,	0_2_00452E51
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: EnumSystemLocalesW,	0_2_00452E06
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: EnumSystemLocalesW,	0_2_00452EEC
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452F77
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	6_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_004531CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_0044B1B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_004532F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_004533F9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_004534CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_0044B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_00452B5A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	6_2_00452D5F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00452E51
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00452E06
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	6_2_00452EEC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00452F77

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\PNO3otPYOa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.16.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.16.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000006.00000002.2840550495.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2823886060.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2855619080.00000000057C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2619633459.00000000057C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PNO3otPYOa.exe PID: 3168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 4956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 4440, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\J7z8s88sXcCE6j1G9cCUUTi.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\r_sRxMygZ5JYHZAcFpnL_Yd.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets*
Source: MPGPH131.exe, 00000006.00000002.2840550495.00000000057D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Jaxx\Local Storage
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walleta_1n
Source: PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walleta_1n
Source: MPGPH131.exe, 00000006.00000002.2840550495.00000000057D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: MPGPH131.exe, 00000006.00000002.2840550495.00000000057D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PNO3otPYOa.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PNO3otPYOa.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2272, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000006.00000002.2840550495.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2823886060.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2855619080.00000000057C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2619633459.00000000057C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PNO3otPYOa.exe PID: 3168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 4956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 4440, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\J7z8s88sXcCE6j1G9cCUUTi.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\r_sRxMygZ5JYHZAcFpnL_Yd.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Virtualization/Sandbox Evasion	Cached Domain Credentials	351 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	13 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PNO3otPYOa.exe	54%	ReversingLabs	Win32.Trojan.RiseProStealer
PNO3otPYOa.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	58%	ReversingLabs	Win32.Trojan.RiseProStealer
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	58%	ReversingLabs	Win32.Trojan.RiseProStealer

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://t.me/risepro_botL	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33r	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exe	100%	Avira URL Cloud	phishing
https://ipinfo.io/widget/demo/8.46.123.33B	0%	Avira URL Cloud	safe
https://ipinfo.io/SE	0%	Avira URL Cloud	safe
https://db-ip.com/~OM	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exe	100%	Avira URL Cloud	phishing
https://db-ip.com/	0%	Avira URL Cloud	safe
https://t.zx	0%	Avira URL Cloud	safe
https://t.me/risepro_botDU	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.3352	0%	Avira URL Cloud	safe
https://t.me/risepro_botY	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33?	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33o	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://t.me/risepro_botisepro_bot	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTF	0%	Avira URL Cloud	safe
https://t.me/risepro_bot.46.123.33b	0%	Avira URL Cloud	safe
https://ipinfo.io/k	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTted88	0%	Avira URL Cloud	safe
https://db-ip.com/Z	0%	Avira URL Cloud	safe
https://t.me/risepro_bot2	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT;	0%	Avira URL Cloud	safe
https://t.7	0%	Avira URL Cloud	safe
https://t.me/risepro_botrisepro	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exen	100%	Avira URL Cloud	phishing
https://ipinfo.io/T	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33x	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://ipinfo.io/Mozilla/5.0	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33G	0%	Avira URL Cloud	safe
https://db-ip.com/PS	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTJ9U	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exe/risepro	100%	Avira URL Cloud	malware
https://t.me/RiseProSUPPORTp;	0%	Avira URL Cloud	safe
https://t.me/risepro_bot	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exeh	100%	Avira URL Cloud	phishing
https://db-ip.com/demo/home.php?s=8.46.123.33?2	0%	Avira URL Cloud	safe
https://db-ip.com/~	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exe00.1	100%	Avira URL Cloud	phishing
https://ipinfo.io/widget/demo/8.46.123.33OV	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://ipinfo.io/uQX	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33s	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exerracoi$	100%	Avira URL Cloud	phishing
https://support.mozilla.org	0%	Avira URL Cloud	safe
https://t.me/risepro_bots	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		unknown
db-ip.com	104.26.4.15	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/8.46.123.33	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.91.77.81/mine/amadka.exe	MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/chrome_newtab	PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F16000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33B	RageMP131.exe, 00000008.00000002.2751365986.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33r	RageMP131.exe, 0000000A.00000002.2752487929.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botL	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exe	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://db-ip.com/~OM	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/SE	RageMP131.exe, 0000000A.00000002.2752487929.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/	MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botDU	RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.zx	RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	false	URL Reputation: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.3352	MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botY	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33?	RageMP131.exe, 0000000A.00000002.2752487929.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	false	URL Reputation: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33o	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botisepro_bot	RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTF	MPGPH131.exe, 00000006.00000002.2838904205.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/k	MPGPH131.exe, 00000006.00000002.2838904205.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot.46.123.33b	MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botrisepro	RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot2	RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT;	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTted88	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.7	MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	false	Avira URL Cloud: safe	unknown
https://db-ip.com/Z	MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exen	MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ipinfo.io/T	MPGPH131.exe, 00000007.00000002.2822679515.0000000000E33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	PNO3otPYOa.exe, 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmp, PNO3otPYOa.exe, 00000000.00000003.2023432722.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2835935957.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2083193308.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2821306165.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2084187915.00000000028C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2749828404.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2165267286.0000000002890000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2245506050.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2750366653.000000000055D000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.16.dr	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057C6000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2840550495.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2823886060.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, J7z8s88sXcCE6j1G9cCUUTi.zip.6.dr, r_sRxMygZ5JYHZAcFpnL_Yd.zip.0.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33x	MPGPH131.exe, 00000006.00000002.2838904205.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/PS	RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/Mozilla/5.0	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F16000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2752487929.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33G	RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTJ9U	MPGPH131.exe, 00000006.00000002.2840550495.00000000057C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.0.dr	false	URL Reputation: safe	unknown
http://77.91.77.81/cost/lenin.exe/risepro	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	false	URL Reputation: safe	unknown
https://t.me/risepro_bot	RageMP131.exe, 0000000A.00000002.2752487929.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr, passwords.txt.6.dr	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTp;	RageMP131.exe, 00000008.00000002.2751365986.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/~	RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33?2	MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exe00.1	MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://77.91.77.81/mine/amadka.exeh	PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.maxmind.com/en/locate-my-ip-address	PNO3otPYOa.exe, MPGPH131.exe	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33OV	MPGPH131.exe, 00000006.00000002.2838904205.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/uQX	RageMP131.exe, 00000008.00000002.2751365986.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	D87fZN3R3jFeplaces.sqlite.0.dr	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33s	RageMP131.exe, 00000008.00000002.2751365986.0000000000CD5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	PNO3otPYOa.exe, 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmp, PNO3otPYOa.exe, 00000000.00000003.2023432722.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2835935957.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.2083193308.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2821306165.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000007.00000003.2084187915.00000000028C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2749828404.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.2165267286.0000000002890000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000003.2245506050.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.2750366653.000000000055D000.00000002.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.0.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exerracoi$	PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://t.me/risepro_bots	PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	PNO3otPYOa.exe, 00000000.00000003.2604183436.0000000005832000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2596706124.000000000582B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2599498555.0000000005B68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2600576237.0000000005C39000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2607497230.0000000005826000.00000004.00000020.00020000.00000000.sdmp, IK3k1Eo6e4pjWeb Data.0.dr, y31C2U2FqEpfWeb Data.6.dr, oRcPvxQGoX66Web Data.6.dr, vSjx5btCeh_cWeb Data.0.dr, Rj9znu7z1UNzWeb Data.0.dr, OkfPwCov6EatWeb Data.6.dr	false	URL Reputation: safe	unknown
http://77.91.77.81/cost/lenin.exe	PNO3otPYOa.exe, 00000000.00000003.2619633459.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2855619080.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, PNO3otPYOa.exe, 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2822679515.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
77.91.77.66	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460309
Start date and time:	2024-06-20 19:36:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PNO3otPYOa.exe renamed because original name is a hash value
Original Sample Name:	ffccf1df9e560e259284b35348a3989f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@14/62@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 67% Number of executed functions: 52 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PNO3otPYOa.exe

Simulations

Behavior and APIs

Time	Type	Description
13:37:33	API Interceptor	156x Sleep call for process: PNO3otPYOa.exe modified
13:37:39	API Interceptor	154x Sleep call for process: MPGPH131.exe modified
13:37:47	API Interceptor	267x Sleep call for process: RageMP131.exe modified
13:38:15	API Interceptor	3x Sleep call for process: WerFault.exe modified
19:37:01	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
19:37:01	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
19:37:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
19:37:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName
77.91.77.66	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse
	AlCsIOd0pd.exe	Get hash	malicious	RisePro Stealer	Browse
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://telegliam.icu/	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://ingresar-365-msn.glitch.me/	Get hash	malicious	Unknown	Browse	34.117.186.192
	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse	34.117.186.192
db-ip.com	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.26.5.15
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	104.26.4.15
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	https://curious-kringle-id4964-024b3b3.netlify.app/form.html	Get hash	malicious	Unknown	Browse	104.26.5.15
	https://glist43-dase23-ac9ae33.netlify.app/dev.html/	Get hash	malicious	Unknown	Browse	104.26.5.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	AlCsIOd0pd.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	77.91.77.81
	setup.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	77.91.77.81
	FN MultiHack v2.exe	Get hash	malicious	RedLine	Browse	77.91.77.6
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments	Get hash	malicious	Unknown	Browse	34.117.239.71
	https://my.visme.co/v/pvmd79je-dj6mqv	Get hash	malicious	Unknown	Browse	34.117.77.79
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://h3200457.wixsite.com/my-site-1/	Get hash	malicious	Unknown	Browse	34.117.60.144
CLOUDFLARENETUS	https://www.guidedtrack.com/programs/a4imwon/run	Get hash	malicious	Unknown	Browse	162.247.243.39
	trec commercial listing agreement 89746.js	Get hash	malicious	Unknown	Browse	172.67.183.149
	Budget_Statement.htm	Get hash	malicious	HTMLPhisher	Browse	104.21.84.200
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments	Get hash	malicious	Unknown	Browse	172.64.151.101
	FAX_202405_136088.xhtml	Get hash	malicious	Unknown	Browse	104.18.11.207
	SecuriteInfo.com.Trojan.PackedNET.2926.9666.23696.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ATT001_PlayVM.html	Get hash	malicious	Unknown	Browse	172.64.151.101
	Products volume.exe	Get hash	malicious	FormBook	Browse	104.21.84.156
	aaaaa.shtml.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	Invoice.docm	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	34.117.186.192 104.26.4.15
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	34.117.186.192 104.26.4.15
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	setup.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	setup.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	Galaxy Swapper v2.0.3.exe	Get hash	malicious	LummaC, Xmrig	Browse	34.117.186.192 104.26.4.15
	setup.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	setup.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3423760
Entropy (8bit):	7.966391554093995
Encrypted:	false
SSDEEP:	49152:VjED/HAkn8SIKu4lB38c1uHHkZZorrS7C8ff3AY1/X0aME7FW3gElVcOQW:dQ4k8StuM3T1qHkDGOC8nwGEaMEYK0
MD5:	FFCCF1DF9E560E259284B35348A3989F
SHA1:	853AD3BEFC8423EBD10442FC1FD3D436B3656AFA
SHA-256:	E2DE3F42BD8737B0B825370AA662CF700B88A05832E4C26A3C7D8A3579B03227
SHA-512:	E6D700471A381CD17F14BA3DE4BD333088154F5079CAA06F150C19525AB9F2D97C3204542EBF24FEBD622478240330076AF7159973B9F9E21B5EE1D6DC8EEBFA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X [...........@.................................K.4......................................a..........8....................................................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..A..........x..............`....boot.....(.. [...(..x..............`..`.reloc...............>4................@................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_ed5e56292ec6c414881791c33eaf25174464651_f4fd270f_3ab4cce7-7f94-442c-b525-21cdd011f3a8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0428076029088806
Encrypted:	false
SSDEEP:	192:8hh/lza8zBn8SE0M8rr6E6jj/ZrUUJcUzuiFJZ24IO8q6t:y+IB//M8rCjqUzuiFJY4IO81
MD5:	9EFE39D094149F62E4B822920C50DAA5
SHA1:	76F8F6720D68276157F19F79076F6449BC5C4F3C
SHA-256:	D46BB0E8623FD7D7674A7C5BF930F7AF296E0F9E541A37135F430FEA635518FE
SHA-512:	1057E4F88D120D83A1EEC9767E24ED0AC85E371AE22F76C9050C23280156020511DDF79CC2CE86DB030BB8437D4D466BF456B790463456B5E5540D0F08769361
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.7.8.6.8.0.1.2.8.8.4.2.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.7.8.6.8.0.7.3.8.2.1.8.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.a.b.4.c.c.e.7.-.7.f.9.4.-.4.4.2.c.-.b.5.2.5.-.2.1.c.d.d.0.1.1.f.3.a.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.c.c.6.7.3.e.-.8.4.9.6.-.4.d.9.7.-.b.0.c.8.-.c.8.4.0.8.b.6.a.f.2.7.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.e.0.-.0.0.0.1.-.0.0.1.4.-.6.c.4.5.-.6.f.7.5.3.8.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.8.5.3.a.d.3.b.e.f.c.8.4.2.3.e.b.d.1.0.4.4.2.f.c.1.f.d.3.d.4.3.6.b.3.6.5.6.a.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_ed5e56292ec6c414881791c33eaf25174464651_f4fd270f_dcff9e5d-ea84-4036-81f5-602fded4e405\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0488163602801615
Encrypted:	false
SSDEEP:	192:oalDa8zS8SE0M8rr6E6jjsZrSfxjPzuiFJZ24IO8q6t:FuIS//M8rCjzPzuiFJY4IO81
MD5:	ED541BBBB4C32673B8C67990E7983086
SHA1:	8489D0A5FE06C2BFD5242EFD2CA8C92E1A319433
SHA-256:	972C669FCC18B0B76C6F8D80CB0DF2C26311C438FA1498C403D7FB3E0AEF25A9
SHA-512:	B083B031F1A3B36A60AF57D2891EF576DEC584A0F18F085BBE9C4FBE2E8AE0178060FE84F74F3E98AA814CEAFA656066816D08394CF41EF08970927EFAF59124
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.7.8.6.7.9.4.4.3.1.4.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.7.8.6.8.0.5.2.1.2.6.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.f.f.9.e.5.d.-.e.a.8.4.-.4.0.3.6.-.8.1.f.5.-.6.0.2.f.d.e.d.4.e.4.0.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.0.a.4.0.3.d.1.-.7.b.b.a.-.4.4.1.3.-.8.8.9.1.-.9.e.9.1.1.6.3.4.8.1.5.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.6.c.-.0.0.0.1.-.0.0.1.4.-.4.f.0.c.-.5.a.7.5.3.8.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.8.5.3.a.d.3.b.e.f.c.8.4.2.3.e.b.d.1.0.4.4.2.f.c.1.f.d.3.d.4.3.6.b.3.6.5.6.a.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PNO3otPYOa.exe_753a15f1ea62c0c59fa48519710a05b67383851_9279f546_e70db0a5-c068-42dc-be37-7da446311566\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0503798544748257
Encrypted:	false
SSDEEP:	192:YU2fQPoHtWe0mdL11jyZrosLZuzuiFJZ24IO8q:cf2oHtWFmdL11jyuzuiFJY4IO8q
MD5:	167EA9DB63CF1BC59132DB9C2C77634C
SHA1:	D02D525D90B260F4EADE5319878CB786188C3EF1
SHA-256:	373B2C5047C2EB7D66F57F4389725A79140ACD395C63AD7A3B5B6FF642835434
SHA-512:	29E3F146A9C0D4B81443BC880B18F3408BA48DB6DDEEBCF3ECEDC22F8A9E4630339E0420597391272F84A676E1E642A4D2B7F413D8FF9F3603D07D2A645138E4
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.7.8.6.7.9.3.5.2.1.6.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.7.8.6.8.0.3.5.2.1.7.0.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.0.d.b.0.a.5.-.c.0.6.8.-.4.2.d.c.-.b.e.3.7.-.7.d.a.4.4.6.3.1.1.5.6.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.b.1.0.c.d.4.-.a.3.6.3.-.4.3.2.4.-.8.a.0.4.-.8.d.5.9.a.6.f.9.f.e.8.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.N.O.3.o.t.P.Y.O.a...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.6.0.-.0.0.0.1.-.0.0.1.4.-.b.5.7.1.-.e.a.7.1.3.8.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.8.5.3.a.d.3.b.e.f.c.8.4.2.3.e.b.d.1.0.4.4.2.f.c.1.f.d.3.d.4.3.6.b.3.6.5.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC90.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 17:37:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	104780
Entropy (8bit):	2.0575593105994767
Encrypted:	false
SSDEEP:	384:FT7/BSjit0VFtvQkDhHgOhoaeR+d6iB9TJfqH0By71dbtp1l6FM6d3nFXXH81XeE:FT7/AmtWFtvnZhoayiPI04re
MD5:	BECA162DC5610CE8E456E84B9D1634AF
SHA1:	7FF337E97D12E014CAEE8939864C3C1B69F2EC9C
SHA-256:	FD9520B613BFF14F24E4159A7DB614EC53C014B923DEE0AC967F27C9660373EF
SHA-512:	D24E2880778BDB55E6A0994F0158D0CC5798AD7D0691B8E36390658FF8B24E0154D8EB6BAA238AA17FF6D413C5968A7694B30B07C9BEA8A80BE635F65C9326D6
Malicious:	false
Preview:	MDMP..a..... ........htf....................................l....#...........L..........`.......8...........T...........`K...M...........#...........%..............................................................................eJ.......&......GenuineIntel............T.......`....htf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCCF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 17:37:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	104260
Entropy (8bit):	2.0441715579868625
Encrypted:	false
SSDEEP:	384:z/rv1c0LQ5ZvgtjojYgG1m+JEuCqLqm4d1xSFZzo3dqeer8cp2pKZ+ZjR+hpNp:fvigQ5Zvgt2qJaZ9S/84c+hd
MD5:	18C17676D4901DA7060783F595F801FE
SHA1:	79AFA7EDD323B99F5943E4CD944533A7F9E98E90
SHA-256:	107FC577502FB59BFD28D05C9426FCF31DF2929C1A43747CFDB1E3907800BD70
SHA-512:	3A0428F45AA5919B1917F07B7D9045CD4C643D2501A5B8450084EF532E79DBDFF7C8AC483E33C142BC90937D429FCE5547AAB49CE7BD2CC694B72C00937DCA76
Malicious:	false
Preview:	MDMP..a..... ........htf....................................l....#...........L..........`.......8...........T...........pJ...L...........#...........%..............................................................................eJ.......&......GenuineIntel............T.......l....htf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE18.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8408
Entropy (8bit):	3.705993732101529
Encrypted:	false
SSDEEP:	192:R6l7wVeJbj6PYdr6YEIvSU925gmf5JjfXHprh89bUZsfly8m:R6lXJf6gdr6YEQSU925gmf5JjfXUUyfe
MD5:	6622A1A902E4D4FB219C726FECBAE381
SHA1:	B52F3A2BA07D29ED3DC13E9C7973B6453BD97049
SHA-256:	AF34BCF1542C17EE89A2D4835C652DCF4F48CA3A7F75CBB54F93B54DF1E49232
SHA-512:	2E2C74D21CDADD98846CDAD2FE5457B8909151DA95779E67B5CC4B14A838B3E05B1A611C3754021375D018CBA9D11459949F9BC0E509D5CF4D69F1A8B25AAD8F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE47.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6380
Entropy (8bit):	3.730119993661587
Encrypted:	false
SSDEEP:	192:R6l7wVeJzuO6RRCxYiJJjyUHprRo89bUxsfF8m:R6lXJ763CxYaJj/7VUqfb
MD5:	8BBA46EAF2E8CEDB613ED9FD62508C44
SHA1:	C65D9BFF24D445F6D3E150CA8F9710087AA49A10
SHA-256:	62DAFB8FD132B6CC3C69EFF307EBEAECC936C2B23EE57297B4D372D004C58264
SHA-512:	73465D1BE26838E77594C0D9D9646AA78B06B3857DF01902035EB6D52E46BB4BFDE5DD2E38C97BF989FFD5DD6C436472F050A8142CE02E86778C2C3864F45E7A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.6.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE67.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4713
Entropy (8bit):	4.527552274411984
Encrypted:	false
SSDEEP:	48:cvIwWl8zslJg77aI978VWpW8VYdYm8M4JwhInFfzHo+q8BRB825youd:uIjf/I7J8k7VpJw2zHoC82youd
MD5:	93A8FF81DD87DAE2AB6AB59CDFE7A40D
SHA1:	27537C0647B916AA2E3D62E8285A1E3F14CBD0D6
SHA-256:	59A17AFA49548550B3612E5A075FED4B07A7D50DA880CABF508A94F535B2D9E5
SHA-512:	83D2229FD3B40985555BDFF6BE0A87A846D89504334562EBD5DD5BE0F34E4F1E67196DA0B6E541E7AA3F24ECCC0DA33DDBDF4ABF64450D8328EC57C957265C59
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376360" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDEB5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.516209579424874
Encrypted:	false
SSDEEP:	48:cvIwWl8zslJg77aI978VWpW8VY1Ym8M4JHFF5q+q8iE825r9Md:uIjf/I7J8k7V1JAU82r9Md
MD5:	067863B398B6EAF3192213417F01ABB2
SHA1:	1209B88B44134BDAEA842824B1D81DC377EBC96D
SHA-256:	BC47836BC342CF4C6C28EFF908EFB467B54236FFC5D6B5BABDEB509D6F387CEE
SHA-512:	B7C2E274875A8EDADBA5E13BE0799819DAA750A465A53E0F3ED905B95EF6DA81FAE6F815A91FBB5D4575FA958BAAF22FCB0F17AA7A67A8AA96368C54D85AFD7F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376360" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF8E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 17:38:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103670
Entropy (8bit):	2.0458217230493223
Encrypted:	false
SSDEEP:	384:8xPsUPpmRtv1oifNA013bYUDdipDAv4Dc8gXRG6xuhJ1uOHsP4vvc:+PNBmRtvJfNK3pDzkO
MD5:	C519B54D5CC0319B87A8FF2554CD85D8
SHA1:	E3EE13ED562D3873D8310CDA37EF8587ECEAEFA3
SHA-256:	C4750FA2DCAB9F8686E845FE171CE27B47BA644E6021E29B5830BCB6B5F43505
SHA-512:	34A84B73FBF2B859255B9395948DBFBE0781327A659E88C87BAF060255780752309438B6D2908B14E84FFDE1FD37874B0DF1E5AA3F5D432D48CE13FE3FEA0C8A
Malicious:	false
Preview:	MDMP..a..... ........htf........................,...........l...$#..........rL..........`.......8...........T............I...K...........#..........\|%..............................................................................eJ.......&......GenuineIntel............T............htf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0B8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6380
Entropy (8bit):	3.730178060711412
Encrypted:	false
SSDEEP:	192:R6l7wVeJsun6P6MYiJJjyUHprR189bPBsf+LFm:R6lXJ16P6MYaJj/7iP6fx
MD5:	BB82C06CFCB46DD1D812454B2E92B759
SHA1:	34C561B5829644134BE0FF9A5C3953EA0BEC442A
SHA-256:	386B3DBBD104BAFE699DE299FCE6489177D5726BDB5CA18E7DB42ABE6DD9E5C2
SHA-512:	655FE1FEF08A323612147684DDFA6C867532133FA0382A002E68B9A080D5662B34825B0C0E74B7C9DD4D40AE654DD4B0D98C51D082ECA8B5DFCAE94FE660A8DE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.2.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0F7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.518034292058
Encrypted:	false
SSDEEP:	48:cvIwWl8zslJg77aI978VWpW8VYSDYm8M4JHFFg+q8iRw825r9dd:uIjf/I7J8k7VaJAa82r9dd
MD5:	59568AA4D5EBBD1BE5B313F64E281226
SHA1:	8B2D8C0B5DF18F5BB01A9AC4991507F9C3F1FBAA
SHA-256:	90458C0B8C6F470BC400C57B8F179BA11FE019832D3131AB84AEC5A644FBF4A8
SHA-512:	9B2F37A332A497CEEE982F3A635746361E150A6B8F0D9B5E92044150FBF8DCA4799C89C8F9D1B60FD601B8E2C5EB9EE237A8C8FD5B1230DB2D181C9A0CC2C900
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376360" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3423760
Entropy (8bit):	7.966391554093995
Encrypted:	false
SSDEEP:	49152:VjED/HAkn8SIKu4lB38c1uHHkZZorrS7C8ff3AY1/X0aME7FW3gElVcOQW:dQ4k8StuM3T1qHkDGOC8nwGEaMEYK0
MD5:	FFCCF1DF9E560E259284B35348A3989F
SHA1:	853AD3BEFC8423EBD10442FC1FD3D436B3656AFA
SHA-256:	E2DE3F42BD8737B0B825370AA662CF700B88A05832E4C26A3C7D8A3579B03227
SHA-512:	E6D700471A381CD17F14BA3DE4BD333088154F5079CAA06F150C19525AB9F2D97C3204542EBF24FEBD622478240330076AF7159973B9F9E21B5EE1D6DC8EEBFA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X [...........@.................................K.4......................................a..........8....................................................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..A..........x..............`....boot.....(.. [...(..x..............`..`.reloc...............>4................@................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\J7z8s88sXcCE6j1G9cCUUTi.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	2794
Entropy (8bit):	7.729283648439079
Encrypted:	false
SSDEEP:	48:9GaJlnPtLea1MSZ9cYcm8w9Xfc8jTUOi4QaNtMNmn3KJ6ukIOfjw:/hfM+9h39E8jAnk3KJp
MD5:	BD60B2EE3EF5605B1E1F2903D91A72C0
SHA1:	5257FB5433A975BEA6FFC6EB354E1C780D6EC189
SHA-256:	B7B35947233B53699C76BB200799BB698DF6537C10C630CB516F95705F7A393D
SHA-512:	82A46BADCB399856C8AC24E5760294C0D458AA1224B71DC92DF654E3A251955AC352924A18DC262609711A8866745B47A626BA37F6EF7A8237C63C4FC0640BBE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\J7z8s88sXcCE6j1G9cCUUTi.zip, Author: Joe Security
Preview:	PK.........l.X................Cookies\..PK.........l.X........$.......Cookies\Chrome_Default.txt....P...5.........`.L2J1l..\@.k.D..M'.t.k[Op...k...=..#T......?T...y..8.!(.h.>....o?.E.<.....EvWV.A....r,.4..\|...u..<..4..T..w..1....._V..a..jZ....qcY..:.T.I.................l9.u..M.n.Q.W..Y3..".i...N.....;.n....t..].\|-8\|....W..v.....If&xA,}.`+5~.....Yx-..3..><9.]K.)..in.. .H=.@..FEH.a..<...0.j...t.J,=>6..z.k.x...N...f.R.+.Y...~i.I..4.....p.Wm...5j.................tI..t.o..E....PK.........l.X7$..c...........information.txtuX.o.F.~G..X./.Z\|..6OMH...p...K.`.Xgld/.......f'."......\|;...:.>..)..o..."....n......5..........J.g.;.(~Jsss.'.aR.L.}....io.'.....Y.......im.O$D..I{..Q.1czA.^@..s.........)..}?..@r..I..,.+..@P?..<G.}.A.qT..2Z...q8..]3...<.1..}Q.$.i..O+..1..E^=..V...E.e.wf.z.e....}.~...,..nF}.xR{..O.n..`..M'../.\|....v.........-.i.U.}...i../U..>.F.P'..-..v..r...$_.%.?.<.<..?].o.#0...[.P..Ze..MUd.....0.....(_...L4yop..\|2.Y...a.x].,....4O.I.4_$..\|xw

C:\Users\user\AppData\Local\Temp\r_sRxMygZ5JYHZAcFpnL_Yd.zip

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	2796
Entropy (8bit):	7.724248494348411
Encrypted:	false
SSDEEP:	48:9kWak5L8DZIJ3SMeH4tRFIelsHBsBMk+pglU5AJHsNt75yjF13xn3KJ6k+kk4Okh:y2t8Du3hx4elwBLkblhHsNtdyjF13x3i
MD5:	AEACADAB4F1A902C160797DDEBEDEB31
SHA1:	25772AD981C7B64D2080A6FB1024B7EC1750D680
SHA-256:	00CEFAB3C386D5BB4921359A7ED121E906AD58A2D9B5303DACC1E0E06564A94E
SHA-512:	B201AE56B2F2544AEDA71AA0F44583C0F197F40A6D69549688E2C3FF39D1D84B5FB74B5D892EA7BB89CAA4ACF439C34230F3DF5784C043C8251D5D334F96E4DD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\r_sRxMygZ5JYHZAcFpnL_Yd.zip, Author: Joe Security
Preview:	PK.........l.X................Cookies\..PK.........l.X..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`\|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!.......y.o;.F..5%.....\|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..\|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK.........l.X.`.p...........information.txtuX]o..}... ..G..t;iw..4h..i........l.Mw....v.f+....EQ..!).../.1q........s[....p0..'......+.........\..I.....\|Lb.^.x..:....2.#%(c.(\fT........i($.i.&#..E).F..F..?......\|...d)".^e1S.t...#A.x...%.qL&.E..<$......8.}.}....]'.....V?.y^.;.[p9y..I.pk6..W.........J.L,..fc..R...@......-./.\|k....e8.~5#'g;gWyQ.c2..y...zL....dVYr.....`b7.3...l ...1..........T.....=.+..E.BnLm.].....d.m...\.5l4.hr9.\|6/K.T....(.E^?..E.;...y....\|..R......(N

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8731406795131336
Encrypted:	false
SSDEEP:	3:L1UwJW:NW
MD5:	FF5612395580C191C4E9F3CA119A8B06
SHA1:	37C0A801E15EEB06303696BF566287D3BB462777
SHA-256:	F378241037786F4A889F87376E35A42CE36DCFD4E3B55E8D648493744AFAF56A
SHA-512:	885DC2E2AE492A6AADADAB8354C3170749533537C73A3E8E233B0D9669064EAA1B8D98303A7AAB3AAAABCA52C4AA5B337E34B79158177A83E20B8370B7E1F43C
Malicious:	false
Preview:	1718910927363

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\0xcCzZDCkizsHistory

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\1KPuF2_u6oa0History

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\1svbu3tIycZmWeb Data

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\9QKiQirM1qXcHistory

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\EAcPxnGdp6toWeb Data

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\IK3k1Eo6e4pjWeb Data

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\JPQQEN02i61OLogin Data

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\JiHPSJNoS6I5Cookies

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\LgWikdVjWsKCHistory

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\Rj9znu7z1UNzWeb Data

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\b4ep9YrEJBiwLogin Data

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\lC_8C6VvGWd_Cookies

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\rxZO4CLkowTrWeb Data

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\tMEkdeo4FFLNLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span7YAMvZf65d3U\vSjx5btCeh_cWeb Data

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\BUCWh4DsXRZeWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\ETQM19BZ8bGnHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\FXnU9BYdLcbYHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\G6hWgD726jZgWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\GK7TDaUZmBPNLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\GREY2_eXs_bRCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\KJUlfwzLYDLDWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\OkfPwCov6EatWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\R5vbmWAWNRBAHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\YWghbxCAFBJrLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\b81p5RNJHBPPLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\cSR7Bpbbm4qNHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\jfotimpUpXrDCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\oRcPvxQGoX66Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanPy9S1QyQDExg\y31C2U2FqEpfWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy7YAMvZf65d3U\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\trixy7YAMvZf65d3U\information.txt

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5140
Entropy (8bit):	5.286496591697342
Encrypted:	false
SSDEEP:	96:xLdJBORymc2KBhA6tsxODsnEV3oyCsoni4UjKdOPzPRcHTHloXdOUJ9zbQY9ZcE6:xYYmX6tsxPnEV3oyCsoni4UjKdOPzPRa
MD5:	6761FFDB0FE5E15DE95518FD35F142A3
SHA1:	67203535AC52419A0259F7D643A3CDED59E8BA62
SHA-256:	35C380D660DD0CA203FB7EE902FA6E32AC2C2607090C57CCD8CAA94BFF65DDBE
SHA-512:	E4B0CDB5A79F8A83023B5235A843BC77F8D092D5F191D80348B443BEC1F27B1F486DF8D50FE4FEFEF08A1FC2A80BE9E1E01B8A583BE7E244B38DF7CE323B7C22
Malicious:	false
Preview:	Build: tumer..Version: 2.0....Date: Thu Jun 20 13:37:58 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 02ff77ab384226fd915bcf536983079b....Path: C:\Users\user\Desktop\PNO3otPYOa.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy7YAMvZf65d3U....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 932923 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 13:37:58..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost

C:\Users\user\AppData\Local\Temp\trixy7YAMvZf65d3U\passwords.txt

Download File

Process:	C:\Users\user\Desktop\PNO3otPYOa.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyPy9S1QyQDExg\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\trixyPy9S1QyQDExg\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5116
Entropy (8bit):	5.2871849182596256
Encrypted:	false
SSDEEP:	96:xLPSORyUc2KBhA6tsxODsnEV3oyCsoni4UjKdOPzPRcHTHloXdOUJ9zbQY9ZcEzh:xpYUX6tsxPnEV3oyCsoni4UjKdOPzPRd
MD5:	DE3534F37A2DD05D29EEF315F1651FB9
SHA1:	4199ACA7014FED63F0EC75509DD548A81B89EAAA
SHA-256:	5737F9BE773E28450221F203CF7887DE809E14A153933F145B43FCF8C97DA8F3
SHA-512:	68E5696919338F004FA9816F95A573329058146DD8D0BAC39705DC240BF9D2F9A6D76DD456146374C871C08FDEBC349ECFBC55C7EEA998804BC7DAEC1F298E66
Malicious:	false
Preview:	Build: tumer..Version: 2.0....Date: Thu Jun 20 13:37:56 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 02ff77ab384226fd915bcf536983079b....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyPy9S1QyQDExg....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 932923 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 13:37:56..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.e

C:\Users\user\AppData\Local\Temp\trixyPy9S1QyQDExg\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.425062681519056
Encrypted:	false
SSDEEP:	6144:ASvfpi6ceLP/9skLmb0OTHWSPHaJG8nAgeMZMMhA2fX4WABlEnNH0uhiTw:rvloTHW+EZMM6DFyd03w
MD5:	2799838E099BE06B530414F7A0226C1A
SHA1:	7B9C652C2BA7E63CC6B80A785A1D8548CE7F8121
SHA-256:	485147C21476864F609B35D13AB84094268D128A94460DA542D70BC94B12E445
SHA-512:	976A75FD3E1AC2D50D35C0C20B320998723898254ABC40516ACBD3DD0559F5DAE3BABE6FBDE09C1ED8853425E6F834CBC21E2F8CB76E33E641E1B929FD4A67B4
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm>...8................................................................................................................................................................................................................................................................................................................................................v..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.966391554093995
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PNO3otPYOa.exe
File size:	3'423'760 bytes
MD5:	ffccf1df9e560e259284b35348a3989f
SHA1:	853ad3befc8423ebd10442fc1fd3d436b3656afa
SHA256:	e2de3f42bd8737b0b825370aa662cf700b88a05832e4c26a3c7d8a3579b03227
SHA512:	e6d700471a381cd17f14ba3de4bd333088154f5079caa06f150c19525ab9f2d97c3204542ebf24febd622478240330076af7159973b9f9e21b5ee1d6dc8eebfa
SSDEEP:	49152:VjED/HAkn8SIKu4lB38c1uHHkZZorrS7C8ff3AY1/X0aME7FW3gElVcOQW:dQ4k8StuM3T1qHkDGOC8nwGEaMEYK0
TLSH:	7AF533F48D252B63CDB27B39F199C2A2C555A70EFE220210D71F4B37E65944C8FA660E
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	8596a1a0a1a1b171

Static PE Info

General

Entrypoint:	0x9b2058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x664C6914 [Tue May 21 09:27:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63814aaf116ba6abb6496ce4bcad24c6

Entrypoint Preview

Instruction
call 00007F7F55145F00h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F7F55145D9Ch
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F7F55145E03h
xor eax, eax
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F7F55145E97h
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F7F55145DBAh
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F7F55145D4Bh
mov eax, 00000001h
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F7F55145D9Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007F7F55145DDAh
mov ecx, 00000001h
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F7F55145DB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F7F55145D9Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19618b	0x184	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18a000	0x1638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x83f000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x197018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x18369c	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x15bbc8	0x9d200	704f84dc4d8bbd70ffda9fffa3164feb	False	0.99894497066428	data	7.9829541104019395	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x15d000	0x27e32	0x10a00	b9b845c2e26aa804b504a540eb5289e9	False	0.9942434210526315	data	7.95626204675532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x185000	0x4930	0x800	6568f0d039b9cb8113af9a3f7d48baa7	False	0.99072265625	data	7.776435545825896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18a000	0x1638	0x1800	fe6f3fdb9e7e97cba92d8ce4e4fcc95b	False	0.7220052083333334	data	6.54017046361188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x18c000	0x9858	0x7200	1e9932f2b29ff172f27a610c95372196	False	0.9780016447368421	data	7.923419598084439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x196000	0x1000	0x400	1b20e07443fa333ff9692026d1e6c6c2	False	0.3984375	data	3.42439969016873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x197000	0x1000	0x200	54a50a058e0f3b6aa2fe1b22e2033106	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x198000	0x41a000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x5b2000	0x28c600	0x28c600	77e4c3ea57cd417e3d9cd40afc7fac04	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x83f000	0x1000	0x10	f5bc99b71bad9e8a775cc32747e3ca58	False	1.5	GLS_BINARY_LSB_FIRST	2.474601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x18a440	0x1060	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.8838263358778626
RT_GROUP_ICON	0x18b4a0	0x14	data	Russian	Russia	1.05
RT_VERSION	0x18a130	0x310	data	Russian	Russia	0.45408163265306123
RT_MANIFEST	0x18b4b8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/20/24-19:37:42.593714	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49707	58709	192.168.2.5	77.91.77.66
06/20/24-19:37:22.677810	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49717	77.91.77.66	192.168.2.5
06/20/24-19:37:42.406359	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49706	58709	192.168.2.5	77.91.77.66
06/20/24-19:38:03.935564	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49717	77.91.77.66	192.168.2.5
06/20/24-19:37:57.156294	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49717	58709	192.168.2.5	77.91.77.66
06/20/24-19:37:15.832806	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49710	77.91.77.66	192.168.2.5
06/20/24-19:37:50.390622	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49710	58709	192.168.2.5	77.91.77.66
06/20/24-19:37:01.301696	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49705	58709	192.168.2.5	77.91.77.66
06/20/24-19:37:47.877509	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49706	77.91.77.66	192.168.2.5
06/20/24-19:37:36.375060	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49705	58709	192.168.2.5	77.91.77.66
06/20/24-19:37:47.713249	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49705	77.91.77.66	192.168.2.5
06/20/24-19:37:47.917742	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49707	77.91.77.66	192.168.2.5
06/20/24-19:37:01.927137	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49705	77.91.77.66	192.168.2.5
06/20/24-19:37:07.981504	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49706	77.91.77.66	192.168.2.5
06/20/24-19:37:08.081416	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49707	77.91.77.66	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 19:37:01.287550926 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:01.292855978 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:01.292953014 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:01.301696062 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:01.307260990 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:01.927136898 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:01.968506098 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:05.047399998 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:05.057240963 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:07.386627913 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:07.391844988 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:07.391941071 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:07.411282063 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:07.416347027 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:07.461322069 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:07.466427088 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:07.466516972 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:07.503098011 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:07.508136988 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:07.981503963 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:08.031112909 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:08.081415892 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:08.124867916 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:11.109308004 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:11.114994049 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:11.234564066 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:11.239604950 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:15.202086926 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:15.207036018 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:15.207138062 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:15.224860907 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:15.230298996 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:15.832806110 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:15.874779940 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:18.953147888 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:18.960094929 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:22.081100941 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:22.086165905 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:22.086261988 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:22.259413958 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:22.266737938 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:22.677809954 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:22.718578100 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:25.812556982 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:25.817529917 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:36.375060081 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:36.380017996 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:42.406358957 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:42.411676884 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:42.593713999 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:42.598709106 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:47.713248968 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:47.760153055 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:47.760243893 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:47.760343075 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:47.761334896 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:47.761370897 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:47.765525103 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:47.877509117 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:47.914457083 CEST	49719	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:47.914489031 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:47.914551020 CEST	49719	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:47.915666103 CEST	49719	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:47.915682077 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:47.917742014 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:47.921751976 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:47.968658924 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.024605989 CEST	49720	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.024638891 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.024714947 CEST	49720	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.025751114 CEST	49720	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.025768042 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.027947903 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.078007936 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.111917019 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.128631115 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.156379938 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.171849966 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.219132900 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.235811949 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.235917091 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.239931107 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.239954948 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.240298033 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.265501022 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.281120062 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.300213099 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.304678917 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.330091000 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.340532064 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.359249115 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.374874115 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.380395889 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.380549908 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.385389090 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.422669888 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.422751904 CEST	49719	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.424065113 CEST	49719	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.424074888 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.425168991 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.436002970 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.436315060 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.436383009 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.438431978 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.438467979 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.438534021 CEST	49718	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.438554049 CEST	443	49718	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.450334072 CEST	49721	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.450362921 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:48.450423956 CEST	49721	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.450757980 CEST	49721	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.450773001 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:48.465256929 CEST	49719	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.466274977 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.466542959 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.471375942 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.501920938 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.502013922 CEST	49720	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.503118038 CEST	49720	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.503123999 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.503901005 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.507531881 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.507653952 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:48.512499094 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.512597084 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:48.540596008 CEST	49720	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.588504076 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.601069927 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.601375103 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.601439953 CEST	49719	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.601778030 CEST	49719	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.601792097 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.601807117 CEST	49719	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.601813078 CEST	443	49719	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.603864908 CEST	49722	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.603893995 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:48.603969097 CEST	49722	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.604266882 CEST	49722	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.604293108 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:48.669451952 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.669748068 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.669943094 CEST	49720	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.670371056 CEST	49720	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.670378923 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.670391083 CEST	49720	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:37:48.670396090 CEST	443	49720	34.117.186.192	192.168.2.5
Jun 20, 2024 19:37:48.672796965 CEST	49723	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.672894001 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:48.673062086 CEST	49723	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.673360109 CEST	49723	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.673398972 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:48.933823109 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:48.933877945 CEST	49721	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.935532093 CEST	49721	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.935537100 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:48.936021090 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:48.937170029 CEST	49721	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:48.984540939 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.090873003 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.090954065 CEST	49722	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.092211962 CEST	49722	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.092223883 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.093290091 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.094626904 CEST	49722	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.136502028 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.143208981 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.143452883 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.143522978 CEST	49721	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.144642115 CEST	49721	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.144659996 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.144670010 CEST	49721	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.144675970 CEST	443	49721	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.145044088 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.147260904 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.147344112 CEST	49723	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.148415089 CEST	49723	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.148430109 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.148643970 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.149745941 CEST	49723	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.150027037 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.192511082 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.257055044 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.257303953 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.257390976 CEST	49722	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.257601023 CEST	49722	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.257615089 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.257637024 CEST	49722	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.257642031 CEST	443	49722	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.262053013 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.266906023 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.313019037 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.313246012 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.314066887 CEST	49723	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.314131975 CEST	49723	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.314131975 CEST	49723	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:37:49.314173937 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.314196110 CEST	443	49723	104.26.4.15	192.168.2.5
Jun 20, 2024 19:37:49.314304113 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.319245100 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.510782957 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.562377930 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.587295055 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.592242956 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.618470907 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.671777964 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.684211969 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.703202963 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.708045959 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.734302998 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.750003099 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.755323887 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.817308903 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.859292030 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.921926022 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.923238993 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.926872015 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:49.968626022 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:49.981969118 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.031127930 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.031258106 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.037857056 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.078188896 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.085988045 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.152786970 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.152812004 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.152829885 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.152862072 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.152887106 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.152920008 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.152942896 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.153266907 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.153297901 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.153347969 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.153709888 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.153764009 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.153769016 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.153808117 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.153856993 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.154078960 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.154186964 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.154221058 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.154269934 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.154637098 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.154690981 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.154891014 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.154978991 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.155008078 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.155039072 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.198272943 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.269437075 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.269507885 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.269547939 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.269572020 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.269582987 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.269624949 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.269639015 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.273401022 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.273457050 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.273514986 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.273521900 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.273550987 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.273586988 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.273638964 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.273941994 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.273972034 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.273993969 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.274048090 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.274105072 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.274137974 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.274157047 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.274194956 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.274480104 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.274509907 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.274790049 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.274840117 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.274847031 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.274882078 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.274899960 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.275846958 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.275876999 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.275927067 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.312520027 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.330236912 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.330364943 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.330399036 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.330429077 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.330435991 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.330800056 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.330852985 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.330858946 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.330893993 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.330943108 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.331598043 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.331634045 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.331646919 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.331671000 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.331717968 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.331883907 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.332091093 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.332123995 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.332159996 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.332185984 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.332205057 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.332284927 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.332613945 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.332644939 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.332667112 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.335519075 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.338052034 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.359328032 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.364569902 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.390621901 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.391218901 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.391266108 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.391302109 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.391331911 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.391371965 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.391407967 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.391465902 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.391468048 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.391525984 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.396122932 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.456624031 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.456657887 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.456712961 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.456749916 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.456783056 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.456783056 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.456815958 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.456820965 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.456880093 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.468789101 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.473613024 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.515569925 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.520549059 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.641670942 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.687426090 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.687485933 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.692421913 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.716586113 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.749308109 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.765515089 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.796776056 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.796906948 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.801963091 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.843704939 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:50.849448919 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.939871073 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:50.984297037 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:51.017709970 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:51.062395096 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:51.072796106 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:51.124912024 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.127661943 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.127758980 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.132817984 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.132837057 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.132849932 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.132865906 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.132882118 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.137629986 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.363117933 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.363348961 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.368205070 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.368308067 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.368338108 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.368366957 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.368388891 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.373296976 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.773056030 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.773134947 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.778233051 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.778276920 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.778306007 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.778301001 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:56.778336048 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:56.783624887 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:57.156294107 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:57.163120031 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:59.265748978 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:59.271281958 CEST	58709	49705	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:59.271358013 CEST	49705	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:59.406270027 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:59.411705017 CEST	58709	49706	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:59.411789894 CEST	49706	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:59.859869957 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:37:59.865382910 CEST	58709	49707	77.91.77.66	192.168.2.5
Jun 20, 2024 19:37:59.865484953 CEST	49707	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:03.523269892 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:03.578073025 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:03.710541964 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:03.765572071 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:03.775671005 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:03.828037024 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:03.881171942 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:03.921787024 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:03.935564041 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:03.977897882 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:04.000121117 CEST	49728	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.000165939 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.000236034 CEST	49728	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.002515078 CEST	49728	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.002535105 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.037000895 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.037034035 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.037276983 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.038769960 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.038783073 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.063477993 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:04.092104912 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:04.109298944 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:04.109535933 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:04.114363909 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:04.140547037 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:04.328336000 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:04.333369017 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:04.465363026 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.465473890 CEST	49728	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.466653109 CEST	49728	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.466691971 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.467365026 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.501372099 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.501517057 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.502563953 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.502573967 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.503341913 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.513350010 CEST	49728	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.546816111 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.547385931 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.556529999 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.592503071 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.650101900 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.650461912 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.650531054 CEST	49728	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.650651932 CEST	49728	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.650688887 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.650716066 CEST	49728	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.650731087 CEST	443	49728	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.652188063 CEST	49730	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:04.652266979 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:04.652347088 CEST	49730	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:04.652658939 CEST	49730	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:04.652693987 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:04.674000025 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.674298048 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.674355030 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.674493074 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.674510002 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.674521923 CEST	49729	443	192.168.2.5	34.117.186.192
Jun 20, 2024 19:38:04.674526930 CEST	443	49729	34.117.186.192	192.168.2.5
Jun 20, 2024 19:38:04.675981998 CEST	49731	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:04.676026106 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:04.676100016 CEST	49731	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:04.676512957 CEST	49731	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:04.676529884 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.336836100 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.336925983 CEST	49730	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.338077068 CEST	49730	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.338100910 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.338931084 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.340460062 CEST	49730	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.368530989 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.368608952 CEST	49731	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.369693041 CEST	49731	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.369704008 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.370182037 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.375382900 CEST	49731	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.380506992 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.416498899 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.514126062 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.514383078 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.514477968 CEST	49730	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.514681101 CEST	49730	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.514727116 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.514758110 CEST	49730	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.514775038 CEST	443	49730	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.515130997 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:05.519934893 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:05.557357073 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.557650089 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.557707071 CEST	49731	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.557784081 CEST	49731	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.557797909 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.557811022 CEST	49731	443	192.168.2.5	104.26.4.15
Jun 20, 2024 19:38:05.557816982 CEST	443	49731	104.26.4.15	192.168.2.5
Jun 20, 2024 19:38:05.557997942 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:05.562764883 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:05.784842968 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:05.828068018 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:05.843800068 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:05.848582029 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:05.863140106 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:05.890779972 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:05.895553112 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:06.108272076 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:06.141623020 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:06.156208992 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:06.187556982 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:09.187539101 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:09.192991018 CEST	58709	49710	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:09.193049908 CEST	49710	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:09.234374046 CEST	49717	58709	192.168.2.5	77.91.77.66
Jun 20, 2024 19:38:09.239528894 CEST	58709	49717	77.91.77.66	192.168.2.5
Jun 20, 2024 19:38:09.239584923 CEST	49717	58709	192.168.2.5	77.91.77.66

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 19:37:47.746732950 CEST	57532	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:37:47.755863905 CEST	53	57532	1.1.1.1	192.168.2.5
Jun 20, 2024 19:37:48.441241980 CEST	61458	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:37:48.449810028 CEST	53	61458	1.1.1.1	192.168.2.5
Jun 20, 2024 19:38:03.915859938 CEST	51458	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:38:03.924170017 CEST	53	51458	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 20, 2024 19:37:47.746732950 CEST	192.168.2.5	1.1.1.1	0x4973	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:37:48.441241980 CEST	192.168.2.5	1.1.1.1	0xddef	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:38:03.915859938 CEST	192.168.2.5	1.1.1.1	0xd680	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 20, 2024 19:37:47.755863905 CEST	1.1.1.1	192.168.2.5	0x4973	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:37:48.449810028 CEST	1.1.1.1	192.168.2.5	0xddef	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:37:48.449810028 CEST	1.1.1.1	192.168.2.5	0xddef	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:37:48.449810028 CEST	1.1.1.1	192.168.2.5	0xddef	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:38:03.924170017 CEST	1.1.1.1	192.168.2.5	0xd680	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

https:

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49704	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:36:50 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-20 17:36:50 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 17:36:50 GMT content-type: application/json; charset=utf-8 Content-Length: 319 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 17:36:50 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49718	34.117.186.192	443	3168	C:\Users\user\Desktop\PNO3otPYOa.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:37:48 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 17:37:48 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 17:37:48 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 17:37:48 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 17:37:48 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49719	34.117.186.192	443	2668	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:37:48 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 17:37:48 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 17:37:48 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 17:37:48 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 17:37:48 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49720	34.117.186.192	443	2272	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:37:48 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 17:37:48 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 17:37:48 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 4 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 17:37:48 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 17:37:48 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49721	104.26.4.15	443	3168	C:\Users\user\Desktop\PNO3otPYOa.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:37:48 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 17:37:49 UTC	657	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 17:37:49 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC466F1C:648C_93878F2E:0050_667468ED_14B4F0FE:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=533%2FzfARlklYQt0DHYY8%2F%2Bqd05V00pGYdOeBGHw7ahZ3QcrTAHaCVgyx9eeeSDT06B%2FCXR9ug588ETexq2o0xiaRp8E9Ij0oPlPsrDHaMj49sj5Jp9Bm8PONmA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896d87694ee70f73-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 17:37:49 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 17:37:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49722	104.26.4.15	443	2668	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:37:49 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 17:37:49 UTC	649	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 17:37:49 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9A1C:781E_93878F2E:0050_667468ED_14C91A01:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ICDa2LLJHOwdVxTz5gXpeBheAwugrFvp5azdxAMiN05xkx0wvcZpZBMuyATvWC4RQL0y4GgBmEjs7vt0JqW7UvFGnM0qXWbvZ2AA7nDBbTqbloN5i6m2SO1FFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896d876a291743c1-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 17:37:49 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 17:37:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	104.26.4.15	443	2272	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:37:49 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 17:37:49 UTC	657	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 17:37:49 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46729A:9CAA_93878F2E:0050_667468ED_14B4F10E:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wjSmtxHan5iM1Xx%2BumM%2FHCUxcJ4Y5yIH%2BSG03o2dbP5DKaWSIXH7u5vWMkw2viS0yZhHjA3SBN7kqQmq0UjJEZdCkhA64EWBSnIbMst5%2BY6FHeoYdomRQHrPdA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896d876a9a3f199d-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 17:37:49 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 17:37:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49728	34.117.186.192	443	4956	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:38:04 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 17:38:04 UTC	515	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 17:38:04 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 11 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 17:38:04 UTC	875	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 17:38:04 UTC	150	IN	Data Raw: 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49729	34.117.186.192	443	4440	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:38:04 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 17:38:04 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 17:38:04 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 17:38:04 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 17:38:04 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49730	104.26.4.15	443	4956	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:38:05 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 17:38:05 UTC	651	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 17:38:05 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9E02:B20A_93878F2E:0050_667468FD_14C91C1F:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QWTe5yzTIony3UO5iutKTXIxCLRWs%2BlQeiIRAADcW0Q4PEEyKtZcJlqobsYKt4EVoDJrRZGrSp98VCqQqnk1aaALoCgg2mHlSisLj2sQymol8beQ3ME25WIxcw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896d87cfde9f41cd-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 17:38:05 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 17:38:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49731	104.26.4.15	443	4440	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:38:05 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 17:38:05 UTC	651	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 17:38:05 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9A18:3A9E_93878F2E:0050_667468FD_14B4F368:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QMF8eEyYVCoMq4wh7PFT3DQVLVQ0BJnQjLpPmITLStbzg5Z52zJzuJwulcfjXFJxyMtug5bMSZxDDMOJw0YLkZHhmDM1CB6UjJ7MEZa5bwuwcvt4I%2B9PNWzXXQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896d87d00af243b9-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 17:38:05 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 17:38:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:36:55
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\PNO3otPYOa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PNO3otPYOa.exe"
Imagebase:	0x400000
File size:	3'423'760 bytes
MD5 hash:	FFCCF1DF9E560E259284B35348A3989F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2855619080.00000000057C6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2619633459.00000000057C6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2851606478.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:37:00
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x6f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:37:00
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:37:00
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x6f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:37:00
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:37:01
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'423'760 bytes
MD5 hash:	FFCCF1DF9E560E259284B35348A3989F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.2840550495.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2838904205.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:37:01
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'423'760 bytes
MD5 hash:	FFCCF1DF9E560E259284B35348A3989F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.2823886060.00000000057C0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:37:09
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'423'760 bytes
MD5 hash:	FFCCF1DF9E560E259284B35348A3989F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:37:17
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'423'760 bytes
MD5 hash:	FFCCF1DF9E560E259284B35348A3989F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:37:58
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 1972
Imagebase:	0x890000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:37:59
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 1916
Imagebase:	0x890000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:37:59
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1736
Imagebase:	0x890000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 0040B8E0 Relevance: 65.9, APIs: 40, Instructions: 5855fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BA08
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BAD2
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040BF80
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040C47A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C575
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040C969
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040CD72
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D17B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040D29A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040D6F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D9DC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040DAD7
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040DE41
CopyFileA.KERNEL32(?,?,00000000), ref: 0040E55A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040ECF6
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040EEEA
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F45B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F525
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 004101ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00410580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0041088D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00410DC4
CopyFileA.KERNEL32(?,?,00000000), ref: 0041173C
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411904
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00411CD7
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411E6E
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411FBE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00410B14

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00410F12
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040FEF1

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040FC55

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F933

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040E6FA

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F

Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0042910D
Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00429155

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040DF3C

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED

CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D5FD

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040BB07

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040BD37
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C0CC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C196

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Directory$Create$File$Copy$Find$Cpp_errorThrow_std::_$AttributesErrorFirstLast$FolderPath___std_fs_convert_narrow_to_wide@20$CloseDeleteNextRemove
String ID:
API String ID: 1172780710-0
Opcode ID: 34ca7d61199ade8f9b9f8bb2510be09db286ba1594c6de4f038b9ce6806e0909
Instruction ID: 57087eddf2f8576e704702d152c9cc5b4e2b87ff67a8e07952ed474be97f1841
Opcode Fuzzy Hash: 34ca7d61199ade8f9b9f8bb2510be09db286ba1594c6de4f038b9ce6806e0909
Instruction Fuzzy Hash: 56F3E2B4D0425D8BDF25CF99C981AEEBBB1BF18304F1041AAD849B7341DB385A85CF69

Function 004AA200 Relevance: 56.8, APIs: 10, Strings: 11, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 004AA277

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F

Strings

;Yb., xrefs: 004BAF18
;Yb., xrefs: 004B62DD
WUa5, xrefs: 004BAC90
Jzv", xrefs: 004BCB48
cannot use operator[] with a string argument with , xrefs: 004B14F5, 004B152D, 004B1580, 004B15B5, 004B15EC, 004B34C2, 004B3500, 004B35B5, 004B83F4, 004B848D, 004BDF6D, 004BE0D4, 004BE129, 004BE17E, 004BE1D9, 004BE22E, 004BE283, 004BE2D8, 004BE32D, 004BE382, 004BFF65, 004BFFA3, 004C0058, 004C1DEA, 004C1E28, 004C1EDD, 004C5EE8, 004C5F20, 004C5FB2
X<b., xrefs: 004B0396
cannot use push_back() with , xrefs: 004B10BB, 004B1333, 004B3367, 004B3558, 004B8296, 004B842E, 004BDFC9, 004BE020, 004BE074, 004BFE23, 004BFFFB, 004C1CD9, 004C1E80, 004C5F5A
;Yb., xrefs: 004B04F0
;Yb., xrefs: 004B26EA
;Yb., xrefs: 004BCCC8
;Yb., xrefs: 004C47B2

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$Jzv"$WUa5$X<b.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-383699475
Opcode ID: 16f782408abad2313021a9bdaf6694d228d992e2eba5a686fc6ee3378a0a0371
Instruction ID: d5c29c46e18a526762dbfc7c8aed9f945ae13eab665394adbd88e65e82b678fb
Opcode Fuzzy Hash: 16f782408abad2313021a9bdaf6694d228d992e2eba5a686fc6ee3378a0a0371
Instruction Fuzzy Hash: 29B433B0D052698BDB25CF68C984BEEBBB1BF49304F1081DAD449A7281DB746F84CF95

Function 004D7600 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0055B192,000000FF), ref: 004D766C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 004D7693
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7959
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7CBB
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004D8DF7
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 004D9992
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA31E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DA3EF
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA712
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAA7D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DAB4E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAE39
CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 004DB0C9
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB27C
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB556
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB93C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 004DBCF1
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DBEA4
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC17E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC564
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9FB3

Part of subcall function 004DFF00: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004E0556
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E05A0

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC99C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DCAF3

Part of subcall function 004DE430: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DE49D

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9C53

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 004D9648

Part of subcall function 004DFF00: FindNextFileA.KERNEL32(00000000,?), ref: 004E056C
Part of subcall function 004DFF00: FindClose.KERNEL32(00000000), ref: 004E057C
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E0582

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004D91DD

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 004D896A

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 004D8B1D
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004D8362

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 004D8623
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D801B

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID:
API String ID: 1140557632-0
Opcode ID: fa1e81d83961fe38e85dc82033a4d740d6e75d93fa40464b700955af23bd6f68
Instruction ID: 6b404ecdfd53acb60f6cf5d734e717c5294ca690171ae70fa85b8f1a38f34a58
Opcode Fuzzy Hash: fa1e81d83961fe38e85dc82033a4d740d6e75d93fa40464b700955af23bd6f68
Instruction Fuzzy Hash: 76F3F2B4D0525A8BCF15CFA9C9916EEBBB0BF18304F20419AD549B7341DB346B84CFA6

Function 00490440 Relevance: 28.0, APIs: 13, Strings: 2, Instructions: 1749registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?), ref: 0049083B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0049086F
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00490895
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490A2C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490CB3
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490DA0
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490EE1
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490FCB
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 004910B5
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0049119F
RegCloseKey.ADVAPI32(?), ref: 0049229B
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 004922D1
RegCloseKey.ADVAPI32(?), ref: 004922E5

Strings

cannot use operator[] with a string argument with , xrefs: 0049239E, 004923F3
cannot use push_back() with , xrefs: 00492345

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2041898428-3306948993
Opcode ID: f785b7c88d275c23fa54bfc851b74a6c6a3d83138168e293f58669b0b68ffe8b
Instruction ID: 6d5f253b48c5edfa20594e0b0a8a78ae050bf84d77acb07cc1b8e3b44561805a
Opcode Fuzzy Hash: f785b7c88d275c23fa54bfc851b74a6c6a3d83138168e293f58669b0b68ffe8b
Instruction Fuzzy Hash: 511322B0C042698BDB25CF68CD84BEEBBB4BF49304F1042EAD549A7241EB756B85CF54

Function 00493F40 Relevance: 26.5, APIs: 12, Strings: 2, Instructions: 1966fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00493FA7

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

FindFirstFileA.KERNEL32(?,?), ref: 0049455F
FindNextFileA.KERNEL32(00000000,?), ref: 0049496C
FindClose.KERNEL32(00000000), ref: 0049497C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00494A53
CreateDirectoryA.KERNEL32(?,00000000), ref: 00494B19
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00494C9D

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 00494E44
CopyFileA.KERNEL32(00000000,?,00000000), ref: 004950F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00495638
CredEnumerateA.SECHOST(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000004), ref: 004959FD
LocalFree.KERNELBASE(00000000,?,?,?,00000004), ref: 004962D7

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,0041ABA8,?,?,?,00431D09,0041ABA8,005799D8,00000000,0041ABA8), ref: 0043525B

Strings

tmX, xrefs: 00493F4D
cannot use operator[] with a string argument with , xrefs: 00496314, 0049636E

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: File$CopyCreateDirectoryFind$Cpp_errorThrow_std::_$AttributesCloseCredEnumerateErrorExceptionFirstFolderFreeLastLocalNextPathRaise
String ID: cannot use operator[] with a string argument with $tmX
API String ID: 3528249430-2011928656
Opcode ID: 67c875fc519223ade0bc42f043923fb92dda2c9050681a3232cc41151ad3c11d
Instruction ID: 1c5c2bc117abc336d538eb0f3ab0e4b698252c7f2e821ac10c87ad1798346723
Opcode Fuzzy Hash: 67c875fc519223ade0bc42f043923fb92dda2c9050681a3232cc41151ad3c11d
Instruction Fuzzy Hash: 0E3310B4C042698BDB25CFA8C994BEDBBB0BF18304F1041EAD849A7351EB346B85CF55

Function 00481C10 Relevance: 21.5, APIs: 7, Strings: 4, Instructions: 2202COMMON

Download Yara Rule

APIs

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 004827AB
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00482AA7
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00482DA5
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00483105
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00483433
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 00483737
Concurrency::cancel_current_task.LIBCPMT ref: 004844E1

Strings

cannot compare iterators of different containers, xrefs: 0048449D
type must be string, but is , xrefs: 0048455B
cannot get value, xrefs: 0048445E, 00484598
type must be boolean, but is , xrefs: 00484507

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: FolderPath$AttributesConcurrency::cancel_current_taskErrorFileLast
String ID: cannot compare iterators of different containers$cannot get value$type must be boolean, but is $type must be string, but is
API String ID: 1974481932-2698695959
Opcode ID: 8c8394144ca38a63eb9d008626406e27d1e09b60dce3b0f21157d948b8cc9afc
Instruction ID: 7d592af2553ac1c7978d8671279e796c0dcb22ab630186640302ddbce1f3b4fb
Opcode Fuzzy Hash: 8c8394144ca38a63eb9d008626406e27d1e09b60dce3b0f21157d948b8cc9afc
Instruction Fuzzy Hash: D74334B0C042698BDB25DF28C994BEEBBB5BF48304F1082DAD449A7281DB756F84CF55

Function 004E6770 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5
SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
DeleteFileA.KERNEL32(?), ref: 004E6AA4
FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
FindClose.KERNEL32(?), ref: 004E6ACA
GetLastError.KERNEL32 ref: 004E6AD0
SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED
RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
GetLastError.KERNEL32 ref: 004E6B20
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Strings

\*.*, xrefs: 004E6834

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: fa9544b1f4525edcf2a18f77abf6cc53c36d2fc4c8b78e4902afa25aa6e8371b
Instruction ID: d809dff945c313677263d2cc5f51936a643c350294cf92fd29307912c56e1fe7
Opcode Fuzzy Hash: fa9544b1f4525edcf2a18f77abf6cc53c36d2fc4c8b78e4902afa25aa6e8371b
Instruction Fuzzy Hash: EDD11670C00288CFDB10DFA9C9487EEBBB1FF65305F20425AE454BB292D7786A89DB55

Function 0049F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049F224
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049F322
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049F515
CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1C76

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1F5D
lstrlen.KERNEL32(?), ref: 004A348E

Strings

;Yb., xrefs: 0049FC4C
~]d, xrefs: 0049FAC6
cannot use operator[] with a string argument with , xrefs: 004A3571, 004A35C6
cannot use push_back() with , xrefs: 004A3518

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $~]d
API String ID: 2833034228-1763774129
Opcode ID: c64df62777c97d322a5cfea44e0c75d64a67c7a654b7d1bd474a30beca6b1a32
Instruction ID: 3f98b5ef17dcfaa8f689e4fcb5a5d7fbbd5e2711f2842c60bb6495c93d0a2e70
Opcode Fuzzy Hash: c64df62777c97d322a5cfea44e0c75d64a67c7a654b7d1bd474a30beca6b1a32
Instruction Fuzzy Hash: 2793DCB4D052A98ADB65CF29C990BEDBBB1BF59304F0081EAD84DA7241DB742BC4CF45

Function 004963B0 Relevance: 17.5, APIs: 5, Strings: 4, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00496504
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00496602
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 004967F5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498078
lstrlen.KERNEL32(?), ref: 0049854F

Strings

;Yb., xrefs: 004974E8
cannot use operator[] with a string argument with , xrefs: 004985BE, 00498670
cannot use push_back() with , xrefs: 0049840C, 0049860E
Tz}9, xrefs: 00497260

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: ;Yb.$Tz}9$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-4100205650
Opcode ID: 8d3e6dffdf2035ca745c78a717b1314b7f03d1281217fdc69459905b70fe160b
Instruction ID: 6b3be8cf9a559e92d133cc3b6572ed682d4dab2050fd03768d9c929fe5be15d2
Opcode Fuzzy Hash: 8d3e6dffdf2035ca745c78a717b1314b7f03d1281217fdc69459905b70fe160b
Instruction Fuzzy Hash: 352300B0D052688BDB25CF28C9947EDBBB5BF49304F1082EAE449A7281DB746BC4CF55

Function 004986B0 Relevance: 16.1, APIs: 4, Strings: 4, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00498804
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00498902
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00498AF8
lstrlen.KERNEL32(?), ref: 0049AE11

Strings

cannot use operator[] with a string argument with , xrefs: 0049AE83, 0049AF19
;Yb., xrefs: 0049968E
cannot use push_back() with , xrefs: 0049AD31, 0049AEBA
AN|5, xrefs: 00499560

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$AN|5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-1903585501
Opcode ID: c61fd068785eb5706be2d1d881a19459dd5c1f669e93ebd6238c48153861a5dd
Instruction ID: e112265f5291f7fbed9e5ebb381307dd27655726dfd0f1f0b2bb5fda635101ca
Opcode Fuzzy Hash: c61fd068785eb5706be2d1d881a19459dd5c1f669e93ebd6238c48153861a5dd
Instruction Fuzzy Hash: D44322B0D052688BDB25CF28C8947EEBBB5BF49304F1082EAD449A7242DB756BC4CF55

Function 0049AF60 Relevance: 14.1, APIs: 4, Strings: 3, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049B158
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049B265
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049B458
lstrlen.KERNEL32(?), ref: 0049D22D

Strings

cannot use operator[] with a string argument with , xrefs: 0049D29C, 0049D353
cannot use push_back() with , xrefs: 0049D0EA, 0049D2EC
;Yb., xrefs: 0049BFEE

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-747751661
Opcode ID: eb01e7d3c7b4992ac3b5486cd6d724a57ea9d84b3281afa8dc1199d7da462e03
Instruction ID: b2dbe3f5757ef5304a2bca7f4d9e3a7c922558eb406562d1b13ccbd165419304
Opcode Fuzzy Hash: eb01e7d3c7b4992ac3b5486cd6d724a57ea9d84b3281afa8dc1199d7da462e03
Instruction Fuzzy Hash: BF2321B0D042688BDB25CF28C9947EDBBB1BF59304F1082EAE449A7281DB746BC4CF55

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
FreeAddrInfoW.WS2_32(?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
FreeAddrInfoW.WS2_32(?), ref: 004C86A5

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 0049D3A0 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049D4F4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049D5F2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049D7E5
lstrlen.KERNEL32(?), ref: 0049EF32

Strings

cannot use operator[] with a string argument with , xrefs: 0049EF9D, 0049EFDB, 0049F08D
cannot use push_back() with , xrefs: 0049EE76, 0049F02B

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: ee728b382585ddabe51e7070e1f48f47b718005594f77a8fe89f200b105bf760
Instruction ID: d38aed82ee4788d52106214de1412b854dd9129e0c255bb6c7140376d04d8967
Opcode Fuzzy Hash: ee728b382585ddabe51e7070e1f48f47b718005594f77a8fe89f200b105bf760
Instruction Fuzzy Hash: 570334B0D042688BDB25CF28C9947EEBBB4BF59304F1042EED449A7281EB746B84CF55

Function 004C6D80 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 535
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004C7051

Part of subcall function 00432534: __EH_prolog3.LIBCMT ref: 00432570

std::_Throw_Cpp_error.LIBCPMT ref: 004C7062

Part of subcall function 004E74C0: __fread_nolock.LIBCMT ref: 004E7609

DeleteFileA.KERNELBASE(?), ref: 004C70EB

Strings

tumer, xrefs: 004C7171, 004C718A
131, xrefs: 004C7135, 004C714E

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$tumer
API String ID: 3880692912-4027956295
Opcode ID: 35ff39eefd4f96a7143577d97fbeb18272b86d3c7c318b3f640f6ce58d8c7bc0
Instruction ID: 7966019704e3fd473910eda9b3190c6326d4c2da0caac65bea49cbac806563d6
Opcode Fuzzy Hash: 35ff39eefd4f96a7143577d97fbeb18272b86d3c7c318b3f640f6ce58d8c7bc0
Instruction Fuzzy Hash: 1E32ACB4D04248CFCB04DFA8C985BAEBBB1BF58304F14419EE8056B392D779AA45CF95

Function 004FAD00 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sqlite_rename_table, xrefs: 004FB0E4
RTRIM, xrefs: 004FAF68
MATCH, xrefs: 004FB108, 004FB119, 004FB139, 004FB13A, 004FB150
automatic extension loading failed: %s, xrefs: 004FB22C
NOCASE, xrefs: 004FB02A
BINARY, xrefs: 004FAF25, 004FAF34, 004FAF4E, 004FAF8E, 004FAF99, 004FAFB1, 004FB003, 004FB004
no such vfs: %s, xrefs: 004FAEB7

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: e2c48bff61029cb8dffcca509652bd956934744efff426072cedd2183155d05b
Instruction ID: 5912c9be0b5fe0253428befa1510005b8e6d21b15bd6994098c8da1f87b2af15
Opcode Fuzzy Hash: e2c48bff61029cb8dffcca509652bd956934744efff426072cedd2183155d05b
Instruction Fuzzy Hash: 510258B0A007089BEB209F15DC4577B7BE4EF51304F14442EEA4A9B391EBB9E944CBC6

Function 004DF030 Relevance: 8.4, APIs: 5, Instructions: 876
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DF09A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF329

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF52A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF84A

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DFC7D

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID:
API String ID: 2127212259-0
Opcode ID: ea0b199c4fb4af4dfba1c20444169e6b1e2b83d792ff13a09952086f6a1055c0
Instruction ID: 8e27dc709fe3b7ff7b62f4d1f71842afe3ac2492894b6e8ccfd466f18f63ab33
Opcode Fuzzy Hash: ea0b199c4fb4af4dfba1c20444169e6b1e2b83d792ff13a09952086f6a1055c0
Instruction Fuzzy Hash: DBA202B4D0425D8BDF25CFA8C995AEEBBB0BF18304F2041AAD949B7351D7341A84CFA5

Function 004DE430 Relevance: 8.2, APIs: 5, Instructions: 731
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DE49D

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DE8C9
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DEA83
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DED11
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DEE67

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID:
API String ID: 1001086254-0
Opcode ID: 853d6f72cb5c0f678857b63163ccb3b14b2a86cf2ef544d30bb23aa5b3a238af
Instruction ID: 4de69712ac24b7a09e9bc2c7d11d42553b755471a164b72fa8c1d2b7ead1c118
Opcode Fuzzy Hash: 853d6f72cb5c0f678857b63163ccb3b14b2a86cf2ef544d30bb23aa5b3a238af
Instruction Fuzzy Hash: 298225B0C042598BCB15CFA9C995BEEBBB0BF18304F10419ED549BB382DB745A85CFA5

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F
FindNextFileA.KERNELBASE(00000000,00000010), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: f762d99c4fa528508f5b9809e2b01a6377f531d297b90f669e44bfe66e34ce6f
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: f762d99c4fa528508f5b9809e2b01a6377f531d297b90f669e44bfe66e34ce6f
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 004C6B00 Relevance: 4.7, APIs: 3, Instructions: 206encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004C6B57
LocalFree.KERNEL32(?), ref: 004C6B86
LocalFree.KERNEL32(?), ref: 004C6C82

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: 1da4f0d34072f6ba30fd19e4896b550e5d176e2ab3d70f0d169f099a65ce9a99
Instruction ID: 6019ec204b0dd747d4126109e6a4f8e7bf51aa55734569d67b400ef60c6c0d13
Opcode Fuzzy Hash: 1da4f0d34072f6ba30fd19e4896b550e5d176e2ab3d70f0d169f099a65ce9a99
Instruction Fuzzy Hash: 6171B171C002489BDB00DFA8C945BEEFBB4EF14314F10826EE851B3391EB786A44DBA5

Function 0053F550 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053F705
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053FA07

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 7cc4ef92f3a6051046a18418b77ea2a3a6de1ed4712a7747bb821a5c40650b69
Instruction ID: 1f76d2344d35fe0e13097961589cbfb84b6978ae6f877586e2245b879765d82e
Opcode Fuzzy Hash: 7cc4ef92f3a6051046a18418b77ea2a3a6de1ed4712a7747bb821a5c40650b69
Instruction Fuzzy Hash: E3029C71A04702AFDB18CF29C840B6ABBE4BF88318F14867DE859D7650D774ED94CB92

Function 0044002D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b15aa9a463d604c256c669c29f6134746f95fa67f9ccc3a2b131056c85d33937
Instruction ID: 127d1e6b524efbadbaaaff55744b8fab0cc6e196c82b7e7b6ae44d0b7ee8643f
Opcode Fuzzy Hash: b15aa9a463d604c256c669c29f6134746f95fa67f9ccc3a2b131056c85d33937
Instruction Fuzzy Hash: 3BB1F67090060A9BFB28CE68D855ABFBBB1AF04304F140A1FDA52A7791C77D9D21CB59

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000358,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Part of subcall function 004C8590: WSAStartup.WS2_32 ref: 004C85BA
Part of subcall function 004C8590: getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
Part of subcall function 004C8590: socket.WS2_32(?,?,?), ref: 004C865D
Part of subcall function 004C8590: connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
Part of subcall function 004C8590: closesocket.WS2_32(00000000), ref: 004C867D
Part of subcall function 004C8590: FreeAddrInfoW.WS2_32(?), ref: 004C868A
Part of subcall function 004C8590: WSACleanup.WS2_32 ref: 004C8690

recv.WS2_32(?,00000004,00000008), ref: 004C7E23
__Xtime_get_ticks.LIBCPMT ref: 004C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004C7EB9

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: 73d8f8bc8ecc92c4a9a5aa98c021befa8569924b62150f826682c5cf68bcecb9
Instruction ID: b3d54dcccad81d83ab75f13ba9899d4b50e1d8608cabcccfb3508871926cac68
Opcode Fuzzy Hash: 73d8f8bc8ecc92c4a9a5aa98c021befa8569924b62150f826682c5cf68bcecb9
Instruction Fuzzy Hash: 9EB1AC71D043089BEB10DBA8CC49BAEBBB1BB54314F24025EE815BB2D2D7785D88DF95

Function 0045E140 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045E3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045E4C6
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0045E808
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045EB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045EC10

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045ED06

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045EDED
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045F06D

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 7c6aeaa58c0b9a153ea23e900c0bdb69a20d50c5e76b04a78abf5970d97d9260
Instruction ID: 0e418cf523baa0a35c0a910b93c4bb77d5942d6061cfe1063ad62b245a56bb8b
Opcode Fuzzy Hash: 7c6aeaa58c0b9a153ea23e900c0bdb69a20d50c5e76b04a78abf5970d97d9260
Instruction Fuzzy Hash: 4FA226B0D012688BCB25DB65CD95BDDBBB4AF14304F0040EED44A67282EB785F88DF5A

Function 004E4720 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 004E4A70
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 004E4ADC
LsaOpenPolicy.ADVAPI32(00000000,00587684,00000001,?), ref: 004E4B35
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 004E4B48
LsaFreeMemory.ADVAPI32(?), ref: 004E4B76
LsaClose.ADVAPI32(?), ref: 004E4B7F

Strings

%wZ, xrefs: 004E4B65
;Yb., xrefs: 004E49C7
&"N, xrefs: 004E472D

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$&"N$;Yb.
API String ID: 762890658-4094109456
Opcode ID: 71ef275a8d6462c4c5fc6e537bb68741ac7498f384360e828531ccc0aa0ebddd
Instruction ID: db120a3af714b361d6db134a28a940fef9e0d4b71911d12d67c4190411436b99
Opcode Fuzzy Hash: 71ef275a8d6462c4c5fc6e537bb68741ac7498f384360e828531ccc0aa0ebddd
Instruction Fuzzy Hash: 1EE101B4D0425A8FDB14CF98C985BEEBBB4BF08304F2041AAE949B7341D7745A85CFA5

Function 00448910 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5c18eac6aee9373ea9a3a89fc0d6f7e951fb066dc8ecf711b9bb6bae0b05c0
Instruction ID: d4d7462daa34083545f9d93f0c5ebf53bf58a01a885379ada905c47cec286c1a
Opcode Fuzzy Hash: af5c18eac6aee9373ea9a3a89fc0d6f7e951fb066dc8ecf711b9bb6bae0b05c0
Instruction Fuzzy Hash: E2B1F4B0A00245AFFB11DF99C881BAE7BB1FF55304F14015EE414AB392CB78AD81CB69

Function 004D6BA0 Relevance: 9.2, APIs: 6, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
6CE37CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50
SetLastError.KERNEL32(00000000), ref: 004D6CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D25
GetLastError.KERNEL32(?,?,00000000), ref: 004D6D33
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D47

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: ErrorLast$CopyFile
String ID:
API String ID: 936320341-0
Opcode ID: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction ID: cca443e56f4e81c83c2dc89493b37bcb85ee1d7da0cfa031959f485395bd6110
Opcode Fuzzy Hash: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction Fuzzy Hash: 6051C172D01219ABCB21CF94DC55BEEBBB8EB04320F10026AE804B3390D7396E05CBA4

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 36229bc7762860d1b94afdb362c75bc9198afe96d6f9a09503f3ca506ee9d700
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: 36229bc7762860d1b94afdb362c75bc9198afe96d6f9a09503f3ca506ee9d700
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 00463830 Relevance: 6.9, APIs: 3, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6C10: CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004E6C55

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00465CB0
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00465FD5

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00465EC6

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 98037bc161112e31a744da87ea9d45df2885168016234282422ba706702991fa
Instruction ID: bdb7de5e538d98cc2bc1e856d074b668cb5d4ba5ca64421d2565693f44b24664
Opcode Fuzzy Hash: 98037bc161112e31a744da87ea9d45df2885168016234282422ba706702991fa
Instruction Fuzzy Hash: 8053CFB0D052688FDB65DF55C994BDDBBB0BB58304F0041EAD44AA7292EB382F84DF49

Function 004E6CA0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 65662f257d92aefc3507c5f8cb9ddc555297535a90f0ce1970463870aaf9e219
Instruction ID: 241e2f942859b358e1133ab4bf22632851a161ac9c5554c12c2f2fb0b7350d8e
Opcode Fuzzy Hash: 65662f257d92aefc3507c5f8cb9ddc555297535a90f0ce1970463870aaf9e219
Instruction Fuzzy Hash: DF11CE71A0028496DB205F6A5C08F6A7F60EB22772F64031BD8359B3D4DB3948058759

Function 00448DFF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E5F

Strings

8a, xrefs: 00448E19

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID: 8a
API String ID: 1687624791-2698673895
Opcode ID: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 004D6790 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 004D6A20

Part of subcall function 004D6BA0: GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
Part of subcall function 004D6BA0: 6CE37CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50

std::_Throw_Cpp_error.LIBCPMT ref: 004D6B84
std::_Throw_Cpp_error.LIBCPMT ref: 004D6B95

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyErrorFileLast
String ID:
API String ID: 1723067277-0
Opcode ID: b4a4ce97f8c673c3844e154375a683749c2501ef21060f82f96e2b15cc183bf8
Instruction ID: af59b977606615079acd7a310a8afa41bd250120d803ccb4a837ad8b48953fd5
Opcode Fuzzy Hash: b4a4ce97f8c673c3844e154375a683749c2501ef21060f82f96e2b15cc183bf8
Instruction Fuzzy Hash: 5BD18BB0C00249DBDB04DFA9C9557EEBBB1BF54304F14419ED80577382EB785A45CBA6

Function 00493B60 Relevance: 4.8, APIs: 3, Instructions: 264registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 00493D89
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?), ref: 00493DAC
RegCloseKey.ADVAPI32(?), ref: 00493DB7

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 77d91e2ffbc41f4e718118182c7f4e60994b52f51d4fd49462c42fe523481256
Instruction ID: c2861601c7c989816088ca7cd521e7ac3defefe444e22908af63c5fcea44e6b0
Opcode Fuzzy Hash: 77d91e2ffbc41f4e718118182c7f4e60994b52f51d4fd49462c42fe523481256
Instruction Fuzzy Hash: C8C136B1D042499FDB14CFA8D986BAEBBB0EF09314F204169E905B7391E7345A84CFA5

Function 004E6C10 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004E6C55

Part of subcall function 00432BAA: RtlReleaseSRWLockExclusive.NTDLL(004E6D30), ref: 00432BBE

std::_Throw_Cpp_error.LIBCPMT ref: 004E6C84
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C95

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 1369faf54573f1097b34743c1b99fafbb3d15d6b7359fe2f2678d7eae3eda35f
Instruction ID: b54f6e02dbe68d52aaf8ce57ceccae370b453a77f91dfdb3bbc81736346272f4
Opcode Fuzzy Hash: 1369faf54573f1097b34743c1b99fafbb3d15d6b7359fe2f2678d7eae3eda35f
Instruction Fuzzy Hash: B2F049B1500640FBD7109F999D06B6ABBA8FB05731F14031AFC35A63D0D7B5190087AA

Function 0044B9D0 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,0043D2B1,?), ref: 0044B9D8
GetLastError.KERNEL32(?,0043D2B1,?), ref: 0044B9E2
__dosmaperr.LIBCMT ref: 0044B9E9

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 09b3d7d03d43d7566e94fc4839c3f2f0e9d57db1a11ed26f70a1bc8201ac59e9
Instruction ID: 29a5b21677c8caf908dcad016bfb5ae84cbfd6cad116b975ceede8be2d8f2443
Opcode Fuzzy Hash: 09b3d7d03d43d7566e94fc4839c3f2f0e9d57db1a11ed26f70a1bc8201ac59e9
Instruction Fuzzy Hash: 00D0C9321146086BEA106BB6BC089163B6D9A913797140616F52CC52A0EE25C895A665

Function 004E57F0 Relevance: 3.4, APIs: 2, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004E588F
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004E5B9B

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: f3331e4acbb6699ef19fe587a09904c02824fa22103a97831a7592332d5ea090
Instruction ID: 009fea26e280c08ebde66711631a2368a09a7ac58c7b38572a32fddf838a6e16
Opcode Fuzzy Hash: f3331e4acbb6699ef19fe587a09904c02824fa22103a97831a7592332d5ea090
Instruction Fuzzy Hash: 81F157B0D002499BDB14CFA8C9957EEBBB1FF08304F24425EE545BB381DB756A84CBA5

Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00448E9F: GetConsoleOutputCP.KERNEL32(5C79D584,00000000,00000000,0043D0C7), ref: 00448F02

WriteFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,?,004E6E3C,?,0043CFE7,004E6E3C,?,00579E10,00000010,0043D0C7), ref: 0044990E
GetLastError.KERNEL32(?,0043CFE7,004E6E3C,?,00579E10,00000010,0043D0C7,004E6E3C,?,00000000,?), ref: 00449918

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 31457cb41688bf9267a4d34aaba0591c787e78cc82baf2098e7bb743f7a0da0b
Instruction ID: 4c198159cf300fc4e9085a349e24ad4d45033eb13303bb4f9288eddf9455663d
Opcode Fuzzy Hash: 31457cb41688bf9267a4d34aaba0591c787e78cc82baf2098e7bb743f7a0da0b
Instruction Fuzzy Hash: 9961C5B1C14119BFEF11DFA8C844AAFBBB9AF49304F14014AE800A7316D739DD05EB65

Function 004D65F0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D676A
std::_Throw_Cpp_error.LIBCPMT ref: 004D677B

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: ee00d86a89ee62715d60b896044e90f690cda42d917c0ef1e64fc9d0a964cb8a
Instruction ID: 177bb7d1701b8dda1f5a90c4ee3be826f8175b366ab48e47effb054e9b4aa952
Opcode Fuzzy Hash: ee00d86a89ee62715d60b896044e90f690cda42d917c0ef1e64fc9d0a964cb8a
Instruction Fuzzy Hash: 6441F2B1E002058BC720DF68995136EBBA1BB94314F19072FE815673D1EB79EA04C795

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,0043D0C7,00000000,00000002,00000000,00000000,00000000,00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000), ref: 00442558
GetLastError.KERNEL32(00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000,?,0044982E,00000000,00000000,00000000,00000002,0043D0C7,00000000), ref: 00442565

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 0044B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B030
GetLastError.KERNEL32(?,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B03B

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction ID: f233056e1464041c82b2d36bf1c88bdb576215b3e64377b8de55bab97aefa9e3
Opcode Fuzzy Hash: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction Fuzzy Hash: 66E08C32100204ABEB212FA5AC0CB9A3B69EF00756F15802AF608971B0DB38C894D798

Function 004C7EF0 Relevance: 1.9, APIs: 1, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb3c3bd782524ca9452cfa108d9499f19190cabffa6b3f3d668b7e84d9a7b29
Instruction ID: 65307ecbef6fb9e01e3d4ad067897c34c173f6a72c2a6aa1ef5fcaa49911cde8
Opcode Fuzzy Hash: efb3c3bd782524ca9452cfa108d9499f19190cabffa6b3f3d668b7e84d9a7b29
Instruction Fuzzy Hash: 0E02A070D04248DFDB14DF68C945BDDBBB0AB14308F14419ED8057B386EBB95E88DB9A

Function 00413D50 Relevance: 1.8, APIs: 1, Instructions: 253COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00414093

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e5e77736cee01c048ca598f33ea93b4c08ab8cd2e48cfadc695183fb4b68044b
Instruction ID: 20828e305faf8902bc30eee05bf9285b15bc31f2c0f4ddd4d11a1ed2060bf189
Opcode Fuzzy Hash: e5e77736cee01c048ca598f33ea93b4c08ab8cd2e48cfadc695183fb4b68044b
Instruction Fuzzy Hash: 21C138B0901249DFDB00CFA9C444799FBF0AF49314F28C1AEE458AB391D77A9A45CF95

Function 00415350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0041546E

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 605aa84c53d1c06fd5e6cdf41f604a7b3fccc91fdcca7bf9b36104f76f86f3cf
Instruction ID: bd448271620100f3a1b1b6e8090fbb17c8ec551eb96fe3ea9a7077eb077db61a
Opcode Fuzzy Hash: 605aa84c53d1c06fd5e6cdf41f604a7b3fccc91fdcca7bf9b36104f76f86f3cf
Instruction Fuzzy Hash: AF6199B1A00614DFCB10CF59C984B9ABBF5FF88310F24816EE8199B391C778EA41CB95

Function 00438E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0750673b6008633cc79045623eaeb207d83782e0e9d8302f40567207ba640ce
Instruction ID: 9663080612542d3e5f9b84a36c3ecf1ef98ea00319430370267f097460dfd66c
Opcode Fuzzy Hash: e0750673b6008633cc79045623eaeb207d83782e0e9d8302f40567207ba640ce
Instruction Fuzzy Hash: 2651C670A00204AFDF14DF59C881AAABBA2EF8D328F24915EF8089B352D775DD41CB55

Function 00429E20 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00429F7B

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8482c0d6c957f33918d9138d1bd6797b8604ed2ab317032aa5cc83da2685a5d5
Instruction ID: efe4cd6a287aa12a83b409d23e88dd93d6c4865ddef84cf0d949cd52fc0f7608
Opcode Fuzzy Hash: 8482c0d6c957f33918d9138d1bd6797b8604ed2ab317032aa5cc83da2685a5d5
Instruction Fuzzy Hash: AA410271E001259FCB14DF68C9419AEBBB9EB89310F64422EE815E7381D738DE01CBE4

Function 004E7640 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E77AC

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 09dbeedca0382fe83fa6e64ccb476af2fb42ace462cdada0f63a81bd75d016a3
Instruction ID: 028c77ef4637c0ac0bfd58be9ca2c186fed01019b569c5d695070078eed700b9
Opcode Fuzzy Hash: 09dbeedca0382fe83fa6e64ccb476af2fb42ace462cdada0f63a81bd75d016a3
Instruction Fuzzy Hash: A8517FB0D043499BDB10DF99D986BAEFBB4FF44714F10012EE8416B381D7796A44CBA5

Function 004E74C0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E7609

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 018f489811a338dcef82faead4130839585db85a1beb9436eeefc27b6700566d
Instruction ID: 959dba962c579710b3c8227977385e6342f185642bc3a86ace1f34c607c4467c
Opcode Fuzzy Hash: 018f489811a338dcef82faead4130839585db85a1beb9436eeefc27b6700566d
Instruction Fuzzy Hash: 78416CB0D04248EBDB14DF99D985BEEBBB4FF48714F10416EE801AB381D7799901CBA5

Function 00406870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00406908

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: c3b8b3600ed0ad07f9a4110fed077291c3700e835e34d0cb827fcc3074b6ad22
Instruction ID: 382a6ddcba4688358f9e0a4ad0208e6a3358ad319658d54a7c18dfc33c73484c
Opcode Fuzzy Hash: c3b8b3600ed0ad07f9a4110fed077291c3700e835e34d0cb827fcc3074b6ad22
Instruction Fuzzy Hash: AB21AE76E00619ABCB14EF49D841BAAB7B4FB84324F00466EED1663780DB396D10CB94

Function 004E5D00 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(0055D560,00000000,00000000), ref: 004E5D47

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction ID: 3af1858aaf6aa964ebdd9f4359c5c99147492c850a3065a18f0c0dee6211d041
Opcode Fuzzy Hash: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction Fuzzy Hash: A0110EB1D04B449BE3208F28DD0A757BBF0EB00B28F10471EE850573C1E3BA6A4887E2

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044A65A Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,000000FF,00000000), ref: 0044A69B

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 44fe68ec2fca24d705c4288583a30094579fd4d4051ae38cb78614132530c581
Instruction ID: 9689b7dccde3e7d2c1426315cc49502dff6dd5535dcc2f3da2dc3831567fdc71
Opcode Fuzzy Hash: 44fe68ec2fca24d705c4288583a30094579fd4d4051ae38cb78614132530c581
Instruction Fuzzy Hash: 4CF0E0311905246BFB216A66DC05B5B375CAF41760F1E8117EC84EB190CA3CDC3146EE

Function 00406840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406853

Part of subcall function 00431F7B: FindNextFileW.KERNELBASE(?,?,?,00406858,?,?,?,?,0040691A,?,?,?,00000000,?,?), ref: 00431F84

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction ID: f155dccb83496c4d8f98fbb14974b26749813e83e467fdfa34ea523ab42003ff
Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction Fuzzy Hash: 63D05E22701520118D24752738085AF06498DC66A8A42447FB84AB32C2EA2D8C0311AD

Function 004466D5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004466DC

Memory Dump Source

Source File: 00000000.00000002.2848746217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2848713865.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848858257.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2848901492.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849064627.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849258759.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000072E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000732000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000736000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000738000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000743000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000745000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000747000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000749000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000780000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2849375383.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2851136094.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PNO3otPYOa.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction ID: ccf5b3b5ee64302dd7184922bc8d264c22512182c10063c293431932d1ea205a
Opcode Fuzzy Hash: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction Fuzzy Hash: 13E09AB2C0020D9ADB00DFD5C452BEFBBB8AB08315F50446BA205E6181EB789748CBE5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PNO3otPYOa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_ed5e56292ec6c414881791c33eaf25174464651_f4fd270f_3ab4cce7-7f94-442c-b525-21cdd011f3a8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_ed5e56292ec6c414881791c33eaf25174464651_f4fd270f_dcff9e5d-ea84-4036-81f5-602fded4e405\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PNO3otPYOa.exe_753a15f1ea62c0c59fa48519710a05b67383851_9279f546_e70db0a5-c068-42dc-be37-7da446311566\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC90.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCCF.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE18.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE47.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE67.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDEB5.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF8E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0B8.tmp.WERInternalMetadata.xml

Windows Analysis Report
PNO3otPYOa.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre