Edit tour

Windows Analysis Report
7rA1iX60wh.exe

Overview

General Information

Sample name:	7rA1iX60wh.exe renamed because original name is a hash value
Original sample name:	a8b80d67357afbd703ee2a13d9cbf339.exe
Analysis ID:	1460406
MD5:	a8b80d67357afbd703ee2a13d9cbf339
SHA1:	68620481e594727f1751d84b1e372a5b72d421f9
SHA256:	f42d98ec4c311b66ce4b40a98db073cfdf86af1e6fa63b8f9a07555cb4e7958d
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

7rA1iX60wh.exe (PID: 6752 cmdline: "C:\Users\user\Desktop\7rA1iX60wh.exe" MD5: A8B80D67357AFBD703EE2A13D9CBF339)

schtasks.exe (PID: 6928 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7072 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6896 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 1944 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 1364 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: A8B80D67357AFBD703EE2A13D9CBF339)

WerFault.exe (PID: 5744 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1860 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 5232 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: A8B80D67357AFBD703EE2A13D9CBF339)

WerFault.exe (PID: 5780 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 1904 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 2004 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: A8B80D67357AFBD703EE2A13D9CBF339)

RageMP131.exe (PID: 6972 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: A8B80D67357AFBD703EE2A13D9CBF339)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\SYv2wcsD2EVzcZNBuLFypWC.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\lw3hbkC7r6iSSxte_tz5rje.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.1984656819.0000000005770000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2009861773.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1805883265.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1806000516.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2010729169.00000000057BB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.1878445681.0000000005793000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1806109261.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7rA1iX60wh.exe PID: 6752	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: 7rA1iX60wh.exe PID: 6752	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 1364	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 1364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 5232	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 5232	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 2004	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 6972	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 20 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\7rA1iX60wh.exe, ProcessId: 6752, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-23:32:17.457498
SID:	2046269
Source Port:	49732
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-23:32:05.022651
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-23:32:01.314499
SID:	2049060
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:32:23.634453
SID:	2046266
Source Port:	58709
Destination Port:	49751
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:32:05.631353
SID:	2046266
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:32:18.079804
SID:	2046267
Source Port:	58709
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:32:16.340233
SID:	2046266
Source Port:	58709
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:32:01.877338
SID:	2046266
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:32:05.646014
SID:	2046266
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-23:32:17.457568
SID:	2046269
Source Port:	49733
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:32:06.016692
SID:	2046267
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:32:06.217335
SID:	2046267
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:32:06.245750
SID:	2046267
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://77.91.77.81/cost/go.exe	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exe	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exet1	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exeshinam	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe0.1	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exeilesCO	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/mine/amadka.exeer	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exet	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7rA1iX60wh.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_004C6B00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		5_2_004C6B00

Source: 7rA1iX60wh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	0_2_00493F40
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004938D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	5_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004938D0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49731 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49731 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49740
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49733 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49740
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49751

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 77.91.77.66 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 77.91.77.66:58709

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15
Source: Joe Sandbox View	IP Address: 77.91.77.66 77.91.77.66

Source: Joe Sandbox View

ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Code function: 0_2_004C8590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,FreeAddrInfoW,WSACleanup,FreeAddrInfoW,

0_2_004C8590

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2010522434.000000000579A000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1878548593.000000000577B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1996805770.000000000577C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984656819.0000000005784000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe
Source: 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805983196.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849083129.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe0.1
Source: 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805983196.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exeilesCO
Source: MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849083129.00000000057D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exeshinam
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exet
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984816945.00000000057D1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe
Source: 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exeer
Source: MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984816945.00000000057D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exet1
Source: Amcache.hve.11.dr	String found in binary or memory: http://upx.sf.net
Source: 7rA1iX60wh.exe, 00000000.00000003.1659354541.0000000002870000.00000004.00001000.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.1994134545.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1696368041.0000000002860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1982433070.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1696579739.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1805385974.0000000000EC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1908108475.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.1891971662.0000000002870000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1990858548.000000000055D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: 7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1742235564.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1909577550.000000000100C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: 7rA1iX60wh.exe, 00000000.00000003.1742235564.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/N
Source: 7rA1iX60wh.exe, 00000000.00000003.1742235564.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/Z
Source: RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33
Source: RageMP131.exe, 00000007.00000002.1909577550.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33LA
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33N
Source: RageMP131.exe, 00000007.00000002.1909577550.000000000100C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33r
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000E22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1909577550.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33J
Source: 7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 00000010.00000002.1992597918.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RageMP131.exe, 00000010.00000002.1992597918.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/:
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1909577550.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/e
Source: 7rA1iX60wh.exe, 00000000.00000003.1659354541.0000000002870000.00000004.00001000.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.1994134545.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1696368041.0000000002860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1982433070.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1696579739.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1805385974.0000000000EC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1908108475.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.1891971662.0000000002870000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1990858548.000000000055D000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/t
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E53000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1909577550.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.330
Source: RageMP131.exe, 00000007.00000002.1909577550.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.338
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33D
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33W
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33ap
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33o
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: RageMP131.exe, 00000007.00000002.1909577550.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.330
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MPGPH131.exe, 00000005.00000003.1836286933.0000000005AF6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1835513578.00000000057E5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1831926883.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp, R0S0RUVxqvyQHistory.0.dr, kIQomd5yBLOGHistory.0.dr, AB89z_t13yqTHistory.6.dr, uXAOMY6nzRJRHistory.6.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016/ee
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016A
Source: MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp, R0S0RUVxqvyQHistory.0.dr, kIQomd5yBLOGHistory.0.dr, AB89z_t13yqTHistory.6.dr, uXAOMY6nzRJRHistory.6.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016R
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp, R0S0RUVxqvyQHistory.0.dr, kIQomd5yBLOGHistory.0.dr, AB89z_t13yqTHistory.6.dr, uXAOMY6nzRJRHistory.6.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17/ewGpY
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17FALSE
Source: MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp, R0S0RUVxqvyQHistory.0.dr, kIQomd5yBLOGHistory.0.dr, AB89z_t13yqTHistory.6.dr, uXAOMY6nzRJRHistory.6.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.M
Source: 7rA1iX60wh.exe, 00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009861773.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057BB000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984656819.0000000005770000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1909577550.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, SYv2wcsD2EVzcZNBuLFypWC.zip.0.dr, lw3hbkC7r6iSSxte_tz5rje.zip.5.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTN
Source: MPGPH131.exe, 00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984656819.0000000005770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTOU
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTQ
Source: RageMP131.exe, 00000007.00000002.1909577550.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTk
Source: 7rA1iX60wh.exe, 00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTr
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTw
Source: RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.5.dr, passwords.txt.0.dr	String found in binary or memory: https://t.me/risepro_bot
Source: RageMP131.exe, 00000007.00000002.1909577550.000000000100C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.cloudflare.c
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot33
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botY
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot_
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_botP
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlater
Source: RageMP131.exe, 00000007.00000002.1909577550.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botm)
Source: RageMP131.exe, 00000007.00000002.1909577550.000000000100C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botraction
Source: 7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 7rA1iX60wh.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805983196.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805641702.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1848839634.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849083129.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984816945.00000000057D1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/6-
Source: 7rA1iX60wh.exe, 00000000.00000003.1803712215.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1798349872.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1797988118.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1798769689.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2010522434.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1830541260.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984656819.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.6.dr, 3b6N2Xdh3CYwplaces.sqlite.6.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805983196.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805641702.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Q
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/u
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805983196.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805641702.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1848839634.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849083129.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984816945.00000000057D1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805983196.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805641702.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/allets
Source: MPGPH131.exe, 00000006.00000003.1848839634.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849083129.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984816945.00000000057D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/e
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/
Source: 7rA1iX60wh.exe, 00000000.00000003.1803712215.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1798349872.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1797988118.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1798769689.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2010522434.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1830541260.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984656819.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.6.dr, 3b6N2Xdh3CYwplaces.sqlite.6.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Code function: 0_2_004E5FF0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,6FE374A0,DeleteObject,DeleteObject,ReleaseDC,

0_2_004E5FF0

System Summary

PE file contains section with special chars

Source: 7rA1iX60wh.exe	Static PE information: section name:
Source: 7rA1iX60wh.exe	Static PE information: section name:
Source: 7rA1iX60wh.exe	Static PE information: section name:
Source: 7rA1iX60wh.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0044002D	0_2_0044002D
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004DF030	0_2_004DF030
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0049F0D0	0_2_0049F0D0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004AA200	0_2_004AA200
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0049D3A0	0_2_0049D3A0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004963B0	0_2_004963B0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00490440	0_2_00490440
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004DE430	0_2_004DE430
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0053F550	0_2_0053F550
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004D7600	0_2_004D7600
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004986B0	0_2_004986B0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0040B8E0	0_2_0040B8E0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00481C10	0_2_00481C10
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004FAD00	0_2_004FAD00
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00493F40	0_2_00493F40
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0049AF60	0_2_0049AF60
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004DFF00	0_2_004DFF00
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00493080	0_2_00493080
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004371A0	0_2_004371A0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0044036F	0_2_0044036F
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004A4320	0_2_004A4320
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004845E0	0_2_004845E0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0042F580	0_2_0042F580
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004A3610	0_2_004A3610
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_005486C0	0_2_005486C0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00547760	0_2_00547760
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004E77E0	0_2_004E77E0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004547BF	0_2_004547BF
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0043C960	0_2_0043C960
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0043A928	0_2_0043A928
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0044DA86	0_2_0044DA86
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00458BB0	0_2_00458BB0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004EEC40	0_2_004EEC40
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004EFC40	0_2_004EFC40
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00534D40	0_2_00534D40
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00546D20	0_2_00546D20
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00545DE0	0_2_00545DE0
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00458E30	0_2_00458E30
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00541F00	0_2_00541F00
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004F2FD0	0_2_004F2FD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044002D	5_2_0044002D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DF030	5_2_004DF030
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0049F0D0	5_2_0049F0D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004AA200	5_2_004AA200
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0049D3A0	5_2_0049D3A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004963B0	5_2_004963B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00490440	5_2_00490440
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DE430	5_2_004DE430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0053F550	5_2_0053F550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004D7600	5_2_004D7600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004986B0	5_2_004986B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0040B8E0	5_2_0040B8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00481C10	5_2_00481C10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004FAD00	5_2_004FAD00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40	5_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0049AF60	5_2_0049AF60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DFF00	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493080	5_2_00493080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004371A0	5_2_004371A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044036F	5_2_0044036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004A4320	5_2_004A4320
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004845E0	5_2_004845E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0042F580	5_2_0042F580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004A3610	5_2_004A3610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005486C0	5_2_005486C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00547760	5_2_00547760
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004E77E0	5_2_004E77E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004547BF	5_2_004547BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043C960	5_2_0043C960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043A928	5_2_0043A928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044DA86	5_2_0044DA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00458BB0	5_2_00458BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004EEC40	5_2_004EEC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004EFC40	5_2_004EFC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00534D40	5_2_00534D40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00546D20	5_2_00546D20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00545DE0	5_2_00545DE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00458E30	5_2_00458E30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00541F00	5_2_00541F00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004F2FD0	5_2_004F2FD0

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: String function: 0041ACE0 appears 86 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0041ACE0 appears 86 times

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 1944

Source: 7rA1iX60wh.exe	Binary or memory string: OriginalFilename vs 7rA1iX60wh.exe
Source: 7rA1iX60wh.exe, 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs 7rA1iX60wh.exe
Source: 7rA1iX60wh.exe, 00000000.00000000.1657068315.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs 7rA1iX60wh.exe
Source: 7rA1iX60wh.exe	Binary or memory string: OriginalFilenamedotnet.exe6 vs 7rA1iX60wh.exe

Source: 7rA1iX60wh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7rA1iX60wh.exe	Static PE information: Section: ZLIB complexity 0.9985052456245028
Source: 7rA1iX60wh.exe	Static PE information: Section: ZLIB complexity 0.9933916823308271
Source: 7rA1iX60wh.exe	Static PE information: Section: ZLIB complexity 0.98974609375
Source: 7rA1iX60wh.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9985052456245028
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9933916823308271
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.98974609375
Source: RageMP131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9985052456245028
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9933916823308271
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.98974609375
Source: MPGPH131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@14/60@2/3

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_004DFF00

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5232
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7060:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6752
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1364

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7rA1iX60wh.exe, 00000000.00000003.1659354541.0000000002870000.00000004.00001000.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.1994134545.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1696368041.0000000002860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1982433070.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1696579739.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1805385974.0000000000EC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1908108475.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.1891971662.0000000002870000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1990858548.000000000055D000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 7rA1iX60wh.exe, 00000000.00000003.1659354541.0000000002870000.00000004.00001000.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.1994134545.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1696368041.0000000002860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1982433070.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1696579739.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1805385974.0000000000EC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1908108475.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.1891971662.0000000002870000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1990858548.000000000055D000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: MPGPH131.exe, 00000005.00000003.1832516736.00000000057C1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1831988470.00000000057A4000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1831764215.00000000057C1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1831495687.00000000057A4000.00000004.00000020.00020000.00000000.sdmp, eYQJ_YGPGqbuLogin Data For Account.6.dr, Rb2xMzRNsLcbLogin Data.6.dr, mf8AS39i8yL1Login Data.0.dr, w8m6J4EPt9q1Login Data For Account.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 7rA1iX60wh.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

File read: C:\Users\user\Desktop\7rA1iX60wh.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7rA1iX60wh.exe "C:\Users\user\Desktop\7rA1iX60wh.exe"
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 1944
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1860
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 1904
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 7rA1iX60wh.exe

Static file information: File size 3308048 > 1048576

Source: 7rA1iX60wh.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x270200

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_004CF280

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: 7rA1iX60wh.exe	Static PE information: section name:
Source: 7rA1iX60wh.exe	Static PE information: section name:
Source: 7rA1iX60wh.exe	Static PE information: section name:
Source: 7rA1iX60wh.exe	Static PE information: section name:
Source: 7rA1iX60wh.exe	Static PE information: section name: .themida
Source: 7rA1iX60wh.exe	Static PE information: section name: .boot
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .themida
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .themida
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_005A8A35 push ecx; mov dword ptr [esp], ebp	0_2_007C5B56
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_005A8A35 push eax; mov dword ptr [esp], esi	0_2_007C5B85
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_005A8A35 push edx; mov dword ptr [esp], ecx	0_2_007C5B93
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_005A8A35 push ebp; mov dword ptr [esp], edi	0_2_007C5BE3
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00588BD8 push 00000063h; retf	0_2_00588BDB
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00588BE4 push dword ptr [ebx-4C02E8F6h]; retf 0000h	0_2_00588EFB
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00433F59 push ecx; ret	0_2_00433F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005A8A35 push ecx; mov dword ptr [esp], ebp	5_2_007C5B56
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005A8A35 push eax; mov dword ptr [esp], esi	5_2_007C5B85
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005A8A35 push edx; mov dword ptr [esp], ecx	5_2_007C5B93
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005A8A35 push ebp; mov dword ptr [esp], edi	5_2_007C5BE3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00433F59 push ecx; ret	5_2_00433F6C

Source: 7rA1iX60wh.exe	Static PE information: section name: entropy: 7.976114758528028
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.976114758528028
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.976114758528028

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Stalling execution: Execution stalls by calling Sleep

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-53826

Source: C:\Users\user\Desktop\7rA1iX60wh.exe TID: 6780	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5800	Thread sleep count: 96 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4924	Thread sleep count: 95 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6996	Thread sleep count: 64 > 30

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	0_2_00493F40
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004938D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	5_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004938D0

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

0_2_004DFF00

Source: RageMP131.exe, 00000007.00000002.1909577550.0000000000F50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&_A
Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: MPGPH131.exe, 00000006.00000002.1984816945.00000000057D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Dk&Ven_VMware&P
Source: 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}<Q7\|
Source: Amcache.hve.11.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_BA2B277D)
Source: RageMP131.exe, 00000007.00000003.1832560960.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}}@
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1742235564.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1742235564.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: RageMP131.exe, 00000010.00000003.1905504331.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7rA1iX60wh.exe, 00000000.00000003.1804907386.00000000057AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}a\*
Source: Amcache.hve.11.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.11.dr	Binary or memory string: vmci.sys
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}R6BwZ
Source: MPGPH131.exe, 00000006.00000003.1879853581.00000000057C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_BA2B277D
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000WSH;.MSCPROCESSOR_ARCHITECTU
Source: 7rA1iX60wh.exe, 00000000.00000002.2010522434.0000000005760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}[
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1
Source: MPGPH131.exe, 00000006.00000003.1847963338.0000000005821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}rf
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MPGPH131.exe, 00000005.00000003.1725523240.0000000000D31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}n
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.11.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.11.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: RageMP131.exe, 00000007.00000002.1909577550.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: RageMP131.exe, 00000010.00000002.1992597918.0000000000ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: RageMP131.exe, 00000010.00000003.1905504331.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.11.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.11.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RageMP131.exe, 00000010.00000002.1992597918.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXI
Source: 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000n
Source: MPGPH131.exe, 00000006.00000003.1848662551.000000000582D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}~j
Source: MPGPH131.exe, 00000006.00000002.1983899285.0000000000E53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.11.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.11.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&L
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: 7rA1iX60wh.exe, 00000000.00000002.2010522434.0000000005760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: RageMP131.exe, 00000007.00000002.1909577550.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J6HEdjEHUub5EtqTQ2dk3wwrCNfruTWZeEqONRrqgXAW0ke6pZXg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*B

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00438A64

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

0_2_004CF280

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004C6D80 mov eax, dword ptr fs:[00000030h]	0_2_004C6D80
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00493F40 mov eax, dword ptr fs:[00000030h]	0_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6D80 mov eax, dword ptr fs:[00000030h]	5_2_004C6D80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40 mov eax, dword ptr fs:[00000030h]	5_2_00493F40

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Code function: 0_2_004E9A70 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

0_2_004E9A70

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043451D
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00438A64
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0043451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00438A64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_004CF280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		5_2_004CF280

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: GetLocaleInfoW,	0_2_004531CA
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: EnumSystemLocalesW,	0_2_0044B1B1
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004532F3
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: GetLocaleInfoW,	0_2_004533F9
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004534CF
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: GetLocaleInfoW,	0_2_0044B734
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00452B5A
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: GetLocaleInfoW,	0_2_00452D5F
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: EnumSystemLocalesW,	0_2_00452E51
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: EnumSystemLocalesW,	0_2_00452E06
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: EnumSystemLocalesW,	0_2_00452EEC
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452F77
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_004531CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_0044B1B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_004532F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_004533F9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_004534CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_0044B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00452B5A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_00452D5F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452E51
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452E06
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452EEC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00452F77

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\7rA1iX60wh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000006.00000002.1984656819.0000000005770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2009861773.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1805883265.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1806000516.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010729169.00000000057BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1878445681.0000000005793000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1806109261.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7rA1iX60wh.exe PID: 6752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\SYv2wcsD2EVzcZNBuLFypWC.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\lw3hbkC7r6iSSxte_tz5rje.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx
Source: 7rA1iX60wh.exe, 00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletS
Source: 7rA1iX60wh.exe, 00000000.00000003.1804907386.00000000057CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: 7rA1iX60wh.exe, 00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletS
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: 7rA1iX60wh.exe, 00000000.00000003.1804907386.00000000057CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.walletP
Source: 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\Pale Moon
Source: 7rA1iX60wh.exe, 00000000.00000003.1804907386.00000000057CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\7rA1iX60wh.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\7rA1iX60wh.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7rA1iX60wh.exe PID: 6752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5232, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000006.00000002.1984656819.0000000005770000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2009861773.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1805883265.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1806000516.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010729169.00000000057BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1878445681.0000000005793000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1806109261.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7rA1iX60wh.exe PID: 6752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 2004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\SYv2wcsD2EVzcZNBuLFypWC.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\lw3hbkC7r6iSSxte_tz5rje.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Virtualization/Sandbox Evasion	Cached Domain Credentials	351 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	13 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7rA1iX60wh.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	55%	ReversingLabs	Win32.Trojan.RiseProStealer
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	55%	ReversingLabs	Win32.Trojan.RiseProStealer

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTw	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33J	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exe	100%	Avira URL Cloud	malware
http://77.91.77.81/mine/amadka.exe	100%	Avira URL Cloud	malware
http://77.91.77.81/mine/amadka.exet1	100%	Avira URL Cloud	phishing
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33D	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	Avira URL Cloud	safe
https://t.me/risepro_botraction	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTk	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTr	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.338	0%	Avira URL Cloud	safe
https://t.me/risepro_botY	0%	Avira URL Cloud	safe
https://db-ip.com/	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33ap	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exeshinam	100%	Avira URL Cloud	phishing
http://77.91.77.81/cost/lenin.exe0.1	100%	Avira URL Cloud	phishing
https://t.me/risepro	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016/ee	0%	Avira URL Cloud	safe
https://t.me/risepro_bot.cloudflare.c	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33N	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exeilesCO	100%	Avira URL Cloud	phishing
https://t.me/RiseProSUPPORTQ	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTN	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17/ewGpY	0%	Avira URL Cloud	safe
https://ipinfo.io/t	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33o	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exeer	100%	Avira URL Cloud	phishing
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016A	0%	Avira URL Cloud	safe
https://db-ip.com/N	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33W	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.330	0%	Avira URL Cloud	safe
https://ipinfo.io/e	0%	Avira URL Cloud	safe
https://t.me/risepro_bot33	0%	Avira URL Cloud	safe
https://db-ip.com/Z	0%	Avira URL Cloud	safe
https://t.me/risepro_botm)	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33LA	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016R	0%	Avira URL Cloud	safe
https://t.me/risepro_botisepro_botP	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	Avira URL Cloud	safe
https://ipinfo.io/Mozilla/5.0	0%	Avira URL Cloud	safe
https://ipinfo.io/:	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exet	100%	Avira URL Cloud	phishing
https://t.me/risepro_bot	0%	Avira URL Cloud	safe
https://t.M	0%	Avira URL Cloud	safe
https://t.me/risepro_botlater	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17FALSE	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.330	0%	Avira URL Cloud	safe
https://t.me/risepro_bot_	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33r	0%	Avira URL Cloud	safe
https://support.mozilla.org	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTOU	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		unknown
db-ip.com	104.26.4.15	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/8.46.123.33	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.91.77.81/mine/amadka.exe	MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984816945.00000000057D1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33J	MPGPH131.exe, 00000005.00000002.1995877183.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33D	7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTw	MPGPH131.exe, 00000006.00000002.1983899285.0000000000E07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/mine/amadka.exet1	MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984816945.00000000057D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/chrome_newtab	7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	D87fZN3R3jFeplaces.sqlite.0.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exe	7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2010522434.000000000579A000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1878548593.000000000577B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1996805770.000000000577C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984656819.0000000005784000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/risepro_botraction	RageMP131.exe, 00000007.00000002.1909577550.000000000100C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTr	7rA1iX60wh.exe, 00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTk	RageMP131.exe, 00000007.00000002.1909577550.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/	7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1742235564.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1909577550.000000000100C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exeshinam	MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849083129.00000000057D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.338	RageMP131.exe, 00000007.00000002.1909577550.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33ap	MPGPH131.exe, 00000005.00000002.1995877183.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp, R0S0RUVxqvyQHistory.0.dr, kIQomd5yBLOGHistory.0.dr, AB89z_t13yqTHistory.6.dr, uXAOMY6nzRJRHistory.6.dr	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botY	MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exe0.1	MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016/ee	MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro	RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot.cloudflare.c	RageMP131.exe, 00000007.00000002.1909577550.000000000100C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33N	MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exeilesCO	7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805983196.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://t.me/RiseProSUPPORTQ	MPGPH131.exe, 00000005.00000002.1995877183.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17/ewGpY	MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp, R0S0RUVxqvyQHistory.0.dr, kIQomd5yBLOGHistory.0.dr, AB89z_t13yqTHistory.6.dr, uXAOMY6nzRJRHistory.6.dr	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTN	7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/t	MPGPH131.exe, 00000006.00000002.1983899285.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33	7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000E22000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1909577550.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33o	7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/mine/amadka.exeer	7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://db-ip.com/N	7rA1iX60wh.exe, 00000000.00000003.1742235564.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33W	MPGPH131.exe, 00000005.00000002.1995877183.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016A	MPGPH131.exe, 00000006.00000002.1983899285.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/e	MPGPH131.exe, 00000005.00000002.1995877183.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.330	RageMP131.exe, 00000007.00000002.1909577550.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot33	MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botm)	RageMP131.exe, 00000007.00000002.1909577550.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/Z	7rA1iX60wh.exe, 00000000.00000003.1742235564.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33LA	RageMP131.exe, 00000007.00000002.1909577550.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016R	MPGPH131.exe, 00000006.00000002.1983899285.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botisepro_botP	MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	7rA1iX60wh.exe, 00000000.00000003.1659354541.0000000002870000.00000004.00001000.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.1994134545.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1696368041.0000000002860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1982433070.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1696579739.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1805385974.0000000000EC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1908108475.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.1891971662.0000000002870000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1990858548.000000000055D000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.11.dr	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	7rA1iX60wh.exe, 00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009861773.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057BB000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000CCD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984656819.0000000005770000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E07000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1909577550.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, SYv2wcsD2EVzcZNBuLFypWC.zip.0.dr, lw3hbkC7r6iSSxte_tz5rje.zip.5.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	MPGPH131.exe, 00000005.00000003.1836286933.0000000005AF6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1835513578.00000000057E5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1831926883.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp, R0S0RUVxqvyQHistory.0.dr, kIQomd5yBLOGHistory.0.dr, AB89z_t13yqTHistory.6.dr, uXAOMY6nzRJRHistory.6.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/Mozilla/5.0	7rA1iX60wh.exe, 00000000.00000002.2009458883.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1909577550.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1992597918.0000000000F4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	false	URL Reputation: safe	unknown
http://77.91.77.81/cost/lenin.exet	7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://t.me/risepro_bot	RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.5.dr, passwords.txt.0.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/:	RageMP131.exe, 00000010.00000002.1992597918.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17FALSE	MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botlater	MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	7rA1iX60wh.exe, MPGPH131.exe	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.330	MPGPH131.exe, 00000006.00000002.1983899285.0000000000E53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.M	RageMP131.exe, 00000010.00000002.1992597918.0000000000F63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot_	7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1760151148.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	7rA1iX60wh.exe, 00000000.00000003.1659354541.0000000002870000.00000004.00001000.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000005.00000002.1994134545.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1696368041.0000000002860000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1982433070.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000006.00000003.1696579739.0000000000DC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000003.1805385974.0000000000EC0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000007.00000002.1908108475.000000000055D000.00000002.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000003.1891971662.0000000002870000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.1990858548.000000000055D000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33r	RageMP131.exe, 00000007.00000002.1909577550.000000000100C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.0.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	MPGPH131.exe, 00000006.00000003.1835916752.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp, R0S0RUVxqvyQHistory.0.dr, kIQomd5yBLOGHistory.0.dr, AB89z_t13yqTHistory.6.dr, uXAOMY6nzRJRHistory.6.dr	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTOU	MPGPH131.exe, 00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1984656819.0000000005770000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	7rA1iX60wh.exe, 00000000.00000003.1799658979.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1799011403.00000000057C7000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1800857195.0000000005800000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1834591904.0000000005B18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1838468818.0000000005B08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1833052520.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1836251157.00000000057F7000.00000004.00000020.00020000.00000000.sdmp, KTLvV8LpVE9pWeb Data.0.dr, U2l6ocEPq0VAWeb Data.6.dr, GpT142gGtTJXWeb Data.6.dr, qcOI72S8Wv9BWeb Data.0.dr, feyUeh_eGCc2Web Data.0.dr, jq2E_9CdxA4hWeb Data.6.dr	false	URL Reputation: safe	unknown
http://77.91.77.81/cost/lenin.exe	7rA1iX60wh.exe, 00000000.00000002.2010729169.00000000057E3000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805983196.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1803593775.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806092362.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, 7rA1iX60wh.exe, 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1995877183.0000000000D45000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849328886.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1849083129.00000000057D0000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
77.91.77.66	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460406
Start date and time:	2024-06-20 23:31:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7rA1iX60wh.exe renamed because original name is a hash value
Original Sample Name:	a8b80d67357afbd703ee2a13d9cbf339.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@14/60@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 68% Number of executed functions: 53 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 7rA1iX60wh.exe

Simulations

Behavior and APIs

Time	Type	Description
17:32:29	API Interceptor	3x Sleep call for process: WerFault.exe modified
22:32:01	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:32:01	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:32:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
22:32:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName
77.91.77.66	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse
	AlCsIOd0pd.exe	Get hash	malicious	RisePro Stealer	Browse
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	PsHQsuTG0H.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://telegliam.icu/	Get hash	malicious	Unknown	Browse	34.117.186.192
db-ip.com	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.26.5.15
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	104.26.4.15
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	https://curious-kringle-id4964-024b3b3.netlify.app/form.html	Get hash	malicious	Unknown	Browse	104.26.5.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	AlCsIOd0pd.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	77.91.77.81
	setup.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	77.91.77.81
	FN MultiHack v2.exe	Get hash	malicious	RedLine	Browse	77.91.77.6
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	PsHQsuTG0H.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments	Get hash	malicious	Unknown	Browse	34.117.239.71
	https://my.visme.co/v/pvmd79je-dj6mqv	Get hash	malicious	Unknown	Browse	34.117.77.79
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
CLOUDFLARENETUS	https://qlwcz.semoxqj.ru/jEmXeUJt/#X	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://qlwcz.semoxqj.ru/jEmXeUJt/#X	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184
	https://sigmaalphalambda.org/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.tools.min.js?ver=5.4.8.3	Get hash	malicious	Unknown	Browse	104.26.7.221
	https://i1h.nechole.ru/9Ciz/	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://criticalsystemsllc-my.sharepoint.com/:o:/p/rlingle/EsvC9Qj-ls9HhKnRaEZ1Lz8BvxH0MI-VHwfPjNPle-U1uw?e=5%3aU5b5yJ&at=9&xsdata=MDV8MDJ8YnBha0BkZXdiZXJyeS5jb218YWEyYWY5MTc3YmRhNDI3YWMwMjUwOGRjOTE1ZjI1OWZ8ODRiN2Y1MzdmYjc2NDJiMmFjMWI0MTVhNTU5Nzc2NmN8MHwwfDYzODU0NTA4NTA0NDA0NDI4OHxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=YmpNTzhSaVBMSktXRzI4YjdkN3g4Um1yTTg1RUtvcGw4enpqT1BjVFpqdz0%3d	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://qlwcz.semoxqj.ru/jEmXeUJt/#X	Get hash	malicious	Unknown	Browse	104.17.2.184
	Direct - Deposit 6192024.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://ms-doc.view-saf-eastsuusex-d0c-file239291.com/?Rg=GHhLs	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	ReceiptCopy37.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://ms-doc.view-saf-eastsuusex-d0c-file239291.com/?Rg=GHhLs	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Form_Ver-18-13-38.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	34.117.186.192 104.26.4.15
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	Invoice.docm	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	34.117.186.192 104.26.4.15
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	34.117.186.192 104.26.4.15
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	setup.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	setup.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	Galaxy Swapper v2.0.3.exe	Get hash	malicious	LummaC, Xmrig	Browse	34.117.186.192 104.26.4.15

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3308048
Entropy (8bit):	7.963565427613973
Encrypted:	false
SSDEEP:	98304:R3Z1B/WjR+4+cpPwD2nn8Dw2Urxqs7w5R:fujXdU2Lxp7wz
MD5:	A8B80D67357AFBD703EE2A13D9CBF339
SHA1:	68620481E594727F1751D84B1E372A5B72D421F9
SHA-256:	F42D98EC4C311B66CE4B40A98DB073CFDF86AF1E6FA63B8F9A07555CB4E7958D
SHA-512:	24C0CA44640A97CCB1A38D8CE98C96E6D307906863DB51C433A540212DF296136871A2E2F0C628689B20914A64B6F172189B73B391AA0DCFE28449A529E265D5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X.X...........@.......................... ........2......................................a..........8....................................................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..>..........x..............`....boot.....'...X...'..x..............`..`.reloc...............z2................@................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7rA1iX60wh.exe_511ab0be63976828f72d7f6d2841b4c9b261a31_cf8b7adb_4ffa0061-89aa-4a4c-b409-95594dce7fb0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0507151286088185
Encrypted:	false
SSDEEP:	192:hL0/QjR0bxwGfjyZrosLZuzuiFlZ24IO8FL:d0/QjSbxwGfjyuzuiFlY4IO8FL
MD5:	19DD008B14F649BEBA66D3D26BEC5584
SHA1:	5E70CE27F6F31EA3F9E4EBDEDDC4C139B5F8C721
SHA-256:	45FC4C6B0B4ECB05DF3F640FB31FA65B419CD20DDBAE3099F6DD1D41ADD0747A
SHA-512:	4F9C0070C16BD801A82CA4C10BF75309B2D33E4F3E893BCB2FDF1FE9521F4F6D93E732ABC3A6D76D72A400D68248F94AEA4A10C64E68B4C27D596CA10B72A0A5
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.9.2.7.3.6.6.2.5.9.2.7.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.9.2.7.3.7.2.1.9.6.7.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.f.a.0.0.6.1.-.8.9.a.a.-.4.a.4.c.-.b.4.0.9.-.9.5.5.9.4.d.c.e.7.f.b.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.4.0.f.a.9.3.4.-.2.a.f.c.-.4.0.8.2.-.8.5.0.2.-.f.4.1.6.b.c.1.4.6.e.a.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.r.A.1.i.X.6.0.w.h...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.6.0.-.0.0.0.1.-.0.0.1.4.-.b.1.7.7.-.3.5.4.7.5.9.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.6.8.6.2.0.4.8.1.e.5.9.4.7.2.7.f.1.7.5.1.d.8.4.b.1.e.3.7.2.a.5.b.7.2.d.4.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_a06fe7d5e939aa5857c5d2fe9ff4c2a9e77a88_f4fd270f_bb4cd91d-df8c-4f38-905d-2e89817ed0fa\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.048951551526084
Encrypted:	false
SSDEEP:	192:TTlplLaPzN8SD0pPso6E6jjRZrVfxjPzuiFlZ24IO8q6t:/J27N/wpPs3jzPzuiFlY4IO81
MD5:	0DA419264DBEE8CF8426141CA1A147C7
SHA1:	6C292446C0EBEBA9A6F118D5C7AF997ED82E91BC
SHA-256:	43572F04D09F18835A9CA7201EEFCA3BF8D6734598DF5E850EE150585090D459
SHA-512:	E5AD0BEA333BEA71AB2C187937C1D0DE58F73B573328F86F419847CD82D9CEBF3AD041A07BA382EAE1E44411018140283A04E00D35E582C8E9770EF651BD986F
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.9.2.7.4.0.0.7.4.3.9.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.9.2.7.4.1.0.7.4.3.9.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.b.4.c.d.9.1.d.-.d.f.8.c.-.4.f.3.8.-.9.0.5.d.-.2.e.8.9.8.1.7.e.d.0.f.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.4.b.2.0.1.1.5.-.2.f.c.9.-.4.c.4.a.-.9.d.f.d.-.e.3.0.2.3.7.7.7.e.6.2.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.5.4.-.0.0.0.1.-.0.0.1.4.-.f.2.d.d.-.5.2.4.9.5.9.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.6.8.6.2.0.4.8.1.e.5.9.4.7.2.7.f.1.7.5.1.d.8.4.b.1.e.3.7.2.a.5.b.7.2.d.4.2.1.f.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_a06fe7d5e939aa5857c5d2fe9ff4c2a9e77a88_f4fd270f_c3495008-d89e-4544-998b-0fae7661c62b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0426073546379673
Encrypted:	false
SSDEEP:	192:3MGAlbaPz88SD0pPso6E6jj/ZrUUJcUzuiFlZ24IO8q6t:8GYm78/wpPs3jqUzuiFlY4IO81
MD5:	A86E885C95A24367D8C3D078CF4B521A
SHA1:	F1A7B377161538C8870E684BF7BCF91D703B28B8
SHA-256:	26EB135AA4B264902E9BF0669B08F67AD44FC8A08126634B38BB96C727566000
SHA-512:	3A08F2F5375A748ED425F52DAB498665FB088A09B637B4750C58551D946DC9D442F9C2EAB904B523144C713D8AF5DC13E416E0979D205839177AFBBBABC544BB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.9.2.7.4.0.7.5.7.5.4.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.9.2.7.4.1.2.8.8.7.9.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.3.4.9.5.0.0.8.-.d.8.9.e.-.4.5.4.4.-.9.9.8.b.-.0.f.a.e.7.6.6.1.c.6.2.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.0.b.d.0.6.3.f.-.9.c.b.4.-.4.5.e.d.-.a.a.b.5.-.9.d.e.2.1.b.7.8.3.d.d.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.7.0.-.0.0.0.1.-.0.0.1.4.-.7.6.0.f.-.6.d.4.9.5.9.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.6.8.6.2.0.4.8.1.e.5.9.4.7.2.7.f.1.7.5.1.d.8.4.b.1.e.3.7.2.a.5.b.7.2.d.4.2.1.f.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2225.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 21:32:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	104800
Entropy (8bit):	2.0535558088577095
Encrypted:	false
SSDEEP:	384:fg3la4SIZidwFtv2crlHEY8bja++1ZG8s4ekDS3zLTj8XnHXX8YCS1F1lVFkbSlp:f+a47ZiyFtv2nax1I1kw
MD5:	2A759BFCC2C6E4B98CD5C7960E82FF1B
SHA1:	43C1CFC3A76BD9302DF9FA866D88E25B531C71D2
SHA-256:	50A95F7CBD70A0D61E0D47184046B107413D6697B83B467F15978B838D8CA5D6
SHA-512:	6801A0371785A54A7EF2CA7874D4A1D13010720C77B2240F7803D8ABFE19D1F8271F8B8473BB1BF290EF82F24145223D0F3E27C9AB2B556FF424EF402F392D56
Malicious:	false
Preview:	MDMP..a..... .........tf....................................l....#...........L..........`.......8...........T...........`K...N...........#...........%..............................................................................eJ.......&......GenuineIntel............T.......`....tf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER239D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.705096504459567
Encrypted:	false
SSDEEP:	192:R6l7wVeJ6Cl66HdU6Y9JSU9V3YzgmfnJJ43sprG89bOBsfOam:R6lXJr66HdU6YzSU9dYzgmfnJJWGO6fK
MD5:	6991927074D068FFE1AF8465AD87BE5A
SHA1:	79D102052DDA0C586B898746EA659BBB8840711E
SHA-256:	13C6BBA86125BB7BA9F5262EEE8C1319E00905F0ACBE62DF82C8FE455076A5FC
SHA-512:	90AC75ED40647348F5366DA5247BEDE34A303B70067F483DBB5F9D31F6033453A98463C0E491D6D305B35DEC29A9171F1ED08AA4E27E311762ED3BE613D6579B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23CD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4713
Entropy (8bit):	4.516174525052626
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgJg77aI947WpW8VYbPYm8M4JCGKF++q8qK48CM6d:uIjfmI7WK7V+SJCa3/8CM6d
MD5:	790001C58E9E904B41F276717C0EF46E
SHA1:	1F4EF23BD5784241F28448CDE3AE628F3524D64D
SHA-256:	EB7D2DC2731BDFB151D3300E78B058E937E604704CD1E9547F86A20022FD3F81
SHA-512:	7D9FE3F9CEB9052F44D13A27963E24B9EEB5179A882DE9177A4FF1D9BF921F56CE66C28897EB7840E0E61E53005E6627C46F8571D38B79E02EC50D0045D2A82B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376594" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F83.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 21:32:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	104280
Entropy (8bit):	2.046570371156321
Encrypted:	false
SSDEEP:	384:eTkWKYNFtvvKCRBq1tD6CT/gZuWKQLqwtxTAFpWDUTYT8jxDvBm:eY9oFtvozgZwQLnsLJ
MD5:	9C9F19C00D53451920CE22AD78A2F5AC
SHA1:	E13044DFE3DB8025D13D2F9A2ABF39D04B5DB5F5
SHA-256:	EDCF80A94704BC46A59BB6BE936CF835224E280D66F0AF669B125FC2C4D8D666
SHA-512:	40ED17DB1DC830431C7300148F127C31107C8AD47A1051AC5A88A1A4EACBE805ED4A6B5B43569560617ADC1B3367AF9F388902A0F9E0238E4999B07FB6D13D40
Malicious:	false
Preview:	MDMP..a..... ........tf....................................l....#...........L..........`.......8...........T...........pJ...L...........#...........%..............................................................................eJ.......&......GenuineIntel............T.......T....tf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31F5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	3.7261727799270314
Encrypted:	false
SSDEEP:	192:R6l7wVeJxu160bSLYiyJJUpra89byMsfKldGm:R6lXJi64SLYRJJiyffKH
MD5:	597933402624A977D25EF184B1ACEE9C
SHA1:	9842349211338E72984A626B401F362CFEFA6E3B
SHA-256:	682F6C0399F1F48531A6385B585BABD90774AD7ED59891AD244E6A970DB801B3
SHA-512:	7236F17E923DF3BDC3605E32ABE48370F6A7ED9C6F895FCE8E24591D3B7A383BF99A8D4BCB0D0B1B247FB671E552B66976C79F3117DBD26D89DACE1ECBAB7778
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3225.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.519581952306753
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI947WpW8VYNa0Ym8M4JHwFor+q8bO8wJs1d:uIjfxI7WK7VfJjrF8wJs1d
MD5:	F8570CE29D98D2C574D3EEA4BC955AE0
SHA1:	846969ECF7482326353A18C62D3072532722D028
SHA-256:	2E1EF4E510BA8AB6BDA08938533D42B4B98013502565E9AED85B64F1C829800C
SHA-512:	65CA2519983FE8CFEC39E278F0949EDA9964A3589E829B2DE2A3A26E4279644F4CD27B6B601FB29EA0C08AE10C4003FB4B5F0393A684BC6BE8AAA9109CBCCC30
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376595" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3242.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 21:32:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103904
Entropy (8bit):	2.0496185379817526
Encrypted:	false
SSDEEP:	384:0CsADSWFAEO1bRtv8Q3EQGeKPiYv+UYpq7EwUEOxqj4jMTATJM+98:h2WCBbRtvKU6YEmd6
MD5:	4B57FE4A6979C201ECD0AF29D234F225
SHA1:	D04C19C6FFE250CA78DF822D3B940376044BC67F
SHA-256:	FBA9BDB8385C772F8D4B492CAD250B3F287D3C01674C7522308496A70CE0A4FF
SHA-512:	C5D4D464A69FFCDE442CBD01EEA750B845683364D21A74273CE6F33509EA5AFDBAD3C89C1AD39562F165ACA5D9DF0B28B7DE912D3EEC8C082624DC717041A3DD
Malicious:	false
Preview:	MDMP..a..... ........tf........................,...........l...$#..........rL..........`.......8...........T...........XI...L...........#..........\|%..............................................................................eJ.......&......GenuineIntel............T.......p....tf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER332E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	3.726548053997114
Encrypted:	false
SSDEEP:	192:R6l7wVeJfux6zS/YiyJJUprZ89b7LsfXJJm:R6lXJY6zS/YRJJX7QfXW
MD5:	F34ABE06DE5266E44CC4D8D918125E97
SHA1:	070F531FF33F9C705B0884414AF1249F8B4CA37E
SHA-256:	4927378CD3835F9C7D0AF03B4FF5B1CEA26DCCBE0305AD6DDB7297A904414562
SHA-512:	0B7D961041BF8662CB734900FF863D87B45800A8D256E12149EB49AF2FD6193C394E756B515B46EA673123C5CC6A665CEF46B5CB538DA93A6C1FC8D40E126EEB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER337D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.518919854744802
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI947WpW8VYNnYm8M4JHwFI+q8b+8wJsud:uIjfxI7WK7VZJBR8wJsud
MD5:	F29DCC0776B7CBCA1D278D91593FF651
SHA1:	923C63B4A2DE8287DD180C32D21B6C773B99E0B3
SHA-256:	F9819AF4EB9B774E9FD9B27073BD0BBB3E04F9BCDE4C170B4DFD75F2598D6E59
SHA-512:	1B31B00FFEDF66CB1903B985754775F40B3C0415A6592465075768D53B3E0F4BE4C21473F86436BDDCAEB519B2329AF9F75304AA56965240CD1ECC0D59989C9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376595" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3308048
Entropy (8bit):	7.963565427613973
Encrypted:	false
SSDEEP:	98304:R3Z1B/WjR+4+cpPwD2nn8Dw2Urxqs7w5R:fujXdU2Lxp7wz
MD5:	A8B80D67357AFBD703EE2A13D9CBF339
SHA1:	68620481E594727F1751D84B1E372A5B72D421F9
SHA-256:	F42D98EC4C311B66CE4B40A98DB073CFDF86AF1E6FA63B8F9A07555CB4E7958D
SHA-512:	24C0CA44640A97CCB1A38D8CE98C96E6D307906863DB51C433A540212DF296136871A2E2F0C628689B20914A64B6F172189B73B391AA0DCFE28449A529E265D5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X.X...........@.......................... ........2......................................a..........8....................................................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..>..........x..............`....boot.....'...X...'..x..............`..`.reloc...............z2................@................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\SYv2wcsD2EVzcZNBuLFypWC.zip

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5541
Entropy (8bit):	7.899424497308472
Encrypted:	false
SSDEEP:	96:ZWGzqeAoMq+YK0KF8cAJiI2i+u3u6gQDNzajlalKZRcnG1B/LOzljc0tVIK63KJP:tqASpF8wF+u6gQD5aRalxG1Glj7O6JP
MD5:	8A9C5CEED3C76FEF125BBD9300DB31DA
SHA1:	EDE80F8EF7802D9C9C4381AB6EACA90AAD4ABCA9
SHA-256:	7A27CFB79078D21713C9FDD251795004BE7AA3D159A946AAB30FEDBEEC530D6A
SHA-512:	3C6E05F8D4C3496B32EBE62EE650288432191AA9C82421024C0D4F066A6B1CDA8010B64C40AE07406B8E6D80724919CA21308866C9B9A26A6A8539036F1B32CE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\SYv2wcsD2EVzcZNBuLFypWC.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\lw3hbkC7r6iSSxte_tz5rje.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5639
Entropy (8bit):	7.894594765783779
Encrypted:	false
SSDEEP:	96:bUT29vHz9WQBavDziBP1Pe4McobRHSImi4AQbRqPdX5cu5DcHh3KJn:bUT29Hz9WGFh1Pe4q4B7AQkPdXvmHh61
MD5:	ED55CEB357DDE83112D02D47E769BF25
SHA1:	09648B7E00CF7FF18FBED296CD71F1D161F37ED8
SHA-256:	7C57118232B3F723622F7A6152BB5A3A66BC803C810991128179CADD27E8CF38
SHA-512:	7C8943DAD33F96FFFDB2B5E0264351E7BFA33C8FC3288DAE0CA0E1FE3A2804900608D808B5C350A5973F5B8F1F5D9441D8B837ADD19C99AB072D78157C328570
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\lw3hbkC7r6iSSxte_tz5rje.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........X..s@..../......Cookies\Chrome_Default.txt.G.....5..G.BMx.....%.M...{...?.LH..71.t.....:y3..s./.0.m.%......../. ..!..A.C.........;...x...........!.2.....Z..<....<.h8..<.q;.....9....gK.}.R.#f...A.E...1...?lR....b.....nS=l.%E&'...>x......h.......E)C..t..'.2<Z_@.........&Lk......0..B.mqk.9M1lf.-e@....E.v..R&..\|..-....C.w.Y.K... ........k..3..2W5.!vs.....S.~.......0._.*..e.....U...).....>...g+;...z[Ks....Z..d...\|.".v..(...I....+.7.y.X@.H....eV.............Y..c..x...Kw.'S>.d\|.....B..k.p..\|C\|F.......O52....`f.3W..../....i..E...7..c.Kwv..,]..C..j.2.T..+............t.2....6.M>..s..K.M...VJ..>;.......n.<f;]s.K..5...n....~$ ....%......Z#.....Q5...<n...I&......0<:..>..I.K)g.)..KX.H.(Y!..j4W.j..1.V..d\.T..,p...D...T..>z...,.....L.....Mh.t..!....A...!?.U...x..[a7j.N;#..t.\.#.Z.-)f...v_.<..?..`.D0..?......).vX.#...Lw.j...1.....M.#...+.W....h....U.W....G.w......'.Y?.....;.....`...X...C..w..

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.5654483718208256
Encrypted:	false
SSDEEP:	3:L1XQcu6:Rs6
MD5:	E0B04B1FAA889F3963BB9122F2571BD8
SHA1:	85708F0BD56809DE1E33C569DCD8E289890DC031
SHA-256:	C1E16BB531DA676F881236827BCEE8A2AF9D59DD18677A0B76BAB65E1F35EE87
SHA-512:	DB2AC7D74A076ED49B3F383B50700F4C932747B5DEE654765DF04FCCA2AD088889E99CE6D8F1A3375FDA9659660DEBF6C36A647BAAD915148F337D2F874D9DE8
Malicious:	false
Preview:	1718925978825

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\KTLvV8LpVE9pWeb Data

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\R0S0RUVxqvyQHistory

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\drK5I6mZQPFzWeb Data

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\fYBtN6WB2te6History

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\feyUeh_eGCc2Web Data

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\kIQomd5yBLOGHistory

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\m8dScJ7a8z3ZLogin Data

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\mf8AS39i8yL1Login Data

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\ndJelY4wftoNWeb Data

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\ngQhft7xiv4THistory

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\oP6Wo1scogyXCookies

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\qcOI72S8Wv9BWeb Data

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\tzWwWCdjTGU8Web Data

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanfMKOdBHYvzaR\w8m6J4EPt9q1Login Data For Account

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\2YzQt69UsAn1History

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\7td_a9XJUaZjHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\9BQxZZWndJ0JWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\AB89z_t13yqTHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\GpT142gGtTJXWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\PYtSMPHrm1SuWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\Rb2xMzRNsLcbLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\U2l6ocEPq0VAWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\doeJFtzaloUBLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\eYQJ_YGPGqbuLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\jq2E_9CdxA4hWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\uXAOMY6nzRJRHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\v3pxjf8ng_oCWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanwHjf0pIE7Aqw\zmamEJ09jjflCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyfMKOdBHYvzaR\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyfMKOdBHYvzaR\information.txt

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6083
Entropy (8bit):	5.532477780895963
Encrypted:	false
SSDEEP:	96:xbPIORk1cT4Aisph+9hcm1kpXUqGfB8S3gkNYx/jIxRYjhe8Ok8l9if1WDZql1DU:xX21vAtphWhcm1kpXeB
MD5:	1A6E9C5C2BCF0F52A172D4FB4CD5F7A5
SHA1:	CD7149C8E9705F2BBD5925349D992BAB8CBD0415
SHA-256:	FAA77D3A8FDD02B172118B255D39CAF31CAFE14333C8F45F90DD59A147AA07DF
SHA-512:	BEC7D235EBC1F7AA004DE57420C39948EFEAE1F58F25EEBABA9DF8216DFC475653D125C3FE22637E7FCED4EFBA9E0BCA825845D1F21C3F5E048B39017772B73D
Malicious:	false
Preview:	Build: binga..Version: 2.0....Date: Thu Jun 20 17:32:12 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 7f48667f87a7a89dff5d6465b689ff1d....Path: C:\Users\user\Desktop\7rA1iX60wh.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyfMKOdBHYvzaR....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 932923 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 17:32:12..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.ex

C:\Users\user\AppData\Local\Temp\trixyfMKOdBHYvzaR\passwords.txt

Download File

Process:	C:\Users\user\Desktop\7rA1iX60wh.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixywHjf0pIE7Aqw\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	12170
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	192:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WhHGYUnOTNC5IcXkWFXZQHRFJ5Pts7c3aP:gwsPbtKvCpqq40wsPbtKvCpqq47
MD5:	B6F52D24FC4333CE4C66DDA3C3735C85
SHA1:	5B69F1D66E95EFE2CF1710E9F58526B2AAEC67E4
SHA-256:	0FEE1A764F541EC6733DB89C823296650F6E581CD7D812D5A142B5A0AD9BC9B6
SHA-512:	CD2C6D64083061D7C7A7E89CF9C9F7D2B66301C73CFB56D2CCD94D1B810DE42774DAE5B77DB2E567A26FC54989C04D8A60D76225E6F3F91FCD2AE4D2E01F3C4C
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixywHjf0pIE7Aqw\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6151
Entropy (8bit):	5.535148434646244
Encrypted:	false
SSDEEP:	96:xbDeORkBcT4Aisph+9hcm1kpXNqGfB8S3gkNYx/jIxRYjhe8Ok8l9if1WDZql1Dc:xJ2BvAtphWhcm1kpXJB
MD5:	3D02D8345E67F47CA0BAACEEC30C76CF
SHA1:	062B0D0C41E50798C8136079BF78A04CA6F8B463
SHA-256:	0A889C5B1604E493E779CB8BF769712456D8E9844F6534C0DE2704F4506DA5D5
SHA-512:	67623135F217F902D37FA68A6694200C1667F774063FD98BE24F7570EDB7956C04CAC86F50C675AD739F8971B2262DF5AD6317C92A163C1BAA34A4E7500C4A3A
Malicious:	false
Preview:	Build: binga..Version: 2.0....Date: Thu Jun 20 17:32:16 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 7f48667f87a7a89dff5d6465b689ff1d....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixywHjf0pIE7Aqw....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 932923 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 17:32:16..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe

C:\Users\user\AppData\Local\Temp\trixywHjf0pIE7Aqw\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469056632174496
Encrypted:	false
SSDEEP:	6144:QIXfpi67eLPU9skLmb0b4kWSPKaJG8nAgejZMMhA2gX4WABl0uNidwBCswSbr:1XD94kWlLZMM6YFHE+r
MD5:	6DEE3533D4D6FC2E422C77BFE8676C4A
SHA1:	C8A7E0804A133A9B889BB40A39A440CBF19DA222
SHA-256:	F88E767CAFC9BBB3156FE8596AD12FE46C0A0A4BE5C748443B3458D6D1FB51C1
SHA-512:	9DB87CBD70A6313E1772C49684673F5D4E9A8825962801A6AC66503B219F650B45CBF7A485A077A42DD36B6C5E3A73425CF9477B9FD2276B6B585480AC6D7A8B
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmB.mRY................................................................................................................................................................................................................................................................................................................................................ezf........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.963565427613973
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7rA1iX60wh.exe
File size:	3'308'048 bytes
MD5:	a8b80d67357afbd703ee2a13d9cbf339
SHA1:	68620481e594727f1751d84b1e372a5b72d421f9
SHA256:	f42d98ec4c311b66ce4b40a98db073cfdf86af1e6fa63b8f9a07555cb4e7958d
SHA512:	24c0ca44640a97ccb1a38d8ce98c96e6d307906863db51c433a540212df296136871a2e2f0c628689b20914a64b6f172189b73b391aa0dcfe28449a529e265d5
SSDEEP:	98304:R3Z1B/WjR+4+cpPwD2nn8Dw2Urxqs7w5R:fujXdU2Lxp7wz
TLSH:	DEE5333370907AB3E4B02DFA587710521DA6BEFF9A931B1911DFDA5A05E734E83A1078
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	8596a1a0a1a1b171

Static PE Info

General

Entrypoint:	0x980058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x664C6914 [Tue May 21 09:27:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63814aaf116ba6abb6496ce4bcad24c6

Entrypoint Preview

Instruction
call 00007F4820E30E00h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F4820E30C9Ch
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F4820E30D03h
xor eax, eax
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F4820E30D97h
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F4820E30CBAh
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F4820E30C4Bh
mov eax, 00000001h
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F4820E30C9Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007F4820E30CDAh
mov ecx, 00000001h
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F4820E30CB7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F4820E30C9Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19618b	0x184	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18a000	0x1638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7f1000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x197018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x18369c	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x15bbc8	0x9d200	ce6560505cf4c77ceeff521f0b1dd0ca	False	0.9985052456245028	data	7.976114758528028	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x15d000	0x27e32	0x10a00	a80c041c9956f89999ec20e40c4195d1	False	0.9933916823308271	data	7.93829062487739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x185000	0x4930	0x800	82a7565b59e6c45c33761fb825711586	False	0.98974609375	OpenPGP Secret Key	7.77625925366548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18a000	0x1638	0x1800	fe6f3fdb9e7e97cba92d8ce4e4fcc95b	False	0.7220052083333334	data	6.54017046361188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x18c000	0x9858	0x7200	dd61d08f502b5631df830501cadfa154	False	0.977453399122807	data	7.92268004130138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x196000	0x1000	0x400	1b20e07443fa333ff9692026d1e6c6c2	False	0.3984375	data	3.42439969016873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x197000	0x1000	0x200	54a50a058e0f3b6aa2fe1b22e2033106	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x198000	0x3e8000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x580000	0x270200	0x270200	7bf41848303f1b24a888b2e0203c9d98	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x7f1000	0x1000	0x10	f5bc99b71bad9e8a775cc32747e3ca58	False	1.5	GLS_BINARY_LSB_FIRST	2.474601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x18a440	0x1060	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.8838263358778626
RT_GROUP_ICON	0x18b4a0	0x14	data	Russian	Russia	1.05
RT_VERSION	0x18a130	0x310	data	Russian	Russia	0.45408163265306123
RT_MANIFEST	0x18b4b8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/20/24-23:32:17.457498	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49732	58709	192.168.2.4	77.91.77.66
06/20/24-23:32:05.022651	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	77.91.77.66
06/20/24-23:32:01.314499	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49731	58709	192.168.2.4	77.91.77.66
06/20/24-23:32:23.634453	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49751	77.91.77.66	192.168.2.4
06/20/24-23:32:05.631353	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49732	77.91.77.66	192.168.2.4
06/20/24-23:32:18.079804	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49740	77.91.77.66	192.168.2.4
06/20/24-23:32:16.340233	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49740	77.91.77.66	192.168.2.4
06/20/24-23:32:01.877338	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49731	77.91.77.66	192.168.2.4
06/20/24-23:32:05.646014	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49733	77.91.77.66	192.168.2.4
06/20/24-23:32:17.457568	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49733	58709	192.168.2.4	77.91.77.66
06/20/24-23:32:06.016692	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49731	77.91.77.66	192.168.2.4
06/20/24-23:32:06.217335	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49732	77.91.77.66	192.168.2.4
06/20/24-23:32:06.245750	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49733	77.91.77.66	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 23:32:01.284159899 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:01.289402008 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:01.289511919 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:01.314498901 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:01.319487095 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:01.877337933 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:01.926182032 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:05.017699003 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:05.022650957 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:05.022922039 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:05.022998095 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:05.027462006 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:05.027765036 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:05.032974005 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:05.033055067 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:05.070060015 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:05.073424101 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:05.075371981 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:05.078217983 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:05.631352901 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:05.646013975 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:05.676299095 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:05.692085981 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:06.016691923 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.066450119 CEST	49734	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.066477060 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.066528082 CEST	49734	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.066777945 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:06.067709923 CEST	49734	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.067724943 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.175215006 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.217334986 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.223052979 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:06.245749950 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.270057917 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:06.301088095 CEST	49735	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.301126957 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.301177025 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:06.301352024 CEST	49735	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.301352024 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.301403046 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.301485062 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.302453041 CEST	49735	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.302465916 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.302474022 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.302481890 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.353059053 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.353195906 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:06.358088017 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.402981043 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.403486013 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:06.408344030 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.418478966 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.418700933 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:06.423906088 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:06.538228035 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.538296938 CEST	49734	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.539797068 CEST	49734	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.539805889 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.540621996 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.577838898 CEST	49734	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.620548964 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.704186916 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.704545021 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.704611063 CEST	49734	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.707199097 CEST	49734	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.707220078 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.707231998 CEST	49734	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.707238913 CEST	443	49734	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.723119020 CEST	49737	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:06.723211050 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:06.723300934 CEST	49737	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:06.723603010 CEST	49737	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:06.723639965 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:06.770047903 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.770153999 CEST	49735	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.771125078 CEST	49735	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.771135092 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.771917105 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.796998024 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.797174931 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.798135042 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.798139095 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.798907995 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.807562113 CEST	49735	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.848031998 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.852494001 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.873418093 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.920527935 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.934148073 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.934305906 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.934367895 CEST	49735	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.934659004 CEST	49735	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.934710026 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.934743881 CEST	49735	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:06.934761047 CEST	443	49735	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:06.937217951 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:06.937314987 CEST	443	49738	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:06.937392950 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:06.937716007 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:06.937753916 CEST	443	49738	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.007236004 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:07.007529974 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:07.007611036 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:07.007785082 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:07.007834911 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:07.007867098 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:07.007884979 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:07.009696960 CEST	49739	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.009774923 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.009840012 CEST	49739	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.010160923 CEST	49739	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.010195017 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.200479031 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.200612068 CEST	49737	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.202891111 CEST	49737	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.202923059 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.203340054 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.204307079 CEST	49737	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.248492956 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.368963003 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.369230032 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.369311094 CEST	49737	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.369395971 CEST	49737	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.369395971 CEST	49737	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.369443893 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.369472027 CEST	443	49737	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.369746923 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:07.374473095 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.421422958 CEST	443	49738	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.421641111 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.422667027 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.422725916 CEST	443	49738	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.423265934 CEST	443	49738	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.424468994 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.472491980 CEST	443	49738	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.483504057 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.483669996 CEST	49739	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.484707117 CEST	49739	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.484731913 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.485255003 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.486357927 CEST	49739	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.528584003 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.577151060 CEST	443	49738	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.577411890 CEST	443	49738	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.577611923 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.577611923 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.577611923 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.577748060 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:07.582494020 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.633549929 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.633872986 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.633977890 CEST	49739	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.634069920 CEST	49739	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.634104013 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.634130955 CEST	49739	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.634149075 CEST	443	49739	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.634310961 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:07.638036966 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.639117002 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.691792011 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:07.691910028 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:07.696953058 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.801302910 CEST	49738	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:07.801379919 CEST	443	49738	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:07.847383976 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.894921064 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:07.905926943 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.910729885 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:07.915649891 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.928591967 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.957416058 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:07.957564116 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:07.962483883 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:07.973138094 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.020037889 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.025057077 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.142793894 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.189744949 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.192003012 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.239021063 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.239829063 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.243917942 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.285907984 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.291397095 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.291945934 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.291960001 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.291975021 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292000055 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292013884 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292021036 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.292032957 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292071104 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.292092085 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.292184114 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292330027 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292432070 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292462111 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.292505980 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292521000 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292553902 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.292891026 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.292902946 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.293045044 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.293077946 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.293092012 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.293126106 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.293323994 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.293378115 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.297024012 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.297044992 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.297200918 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.409118891 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.409136057 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.409152031 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.409216881 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.409298897 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.495779991 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:08.551219940 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.567045927 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:08.572169065 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.038077116 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.067529917 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.067550898 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.067611933 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.067656994 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.067846060 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.067862988 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.067889929 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.068197012 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.068212986 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.068229914 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.068240881 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.068243980 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.068278074 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.068352938 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.068397045 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.068546057 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.068562984 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.068578959 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.068604946 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.068890095 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.068933964 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.069058895 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.074296951 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.074353933 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.079922915 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.080266953 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.080332041 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.082036972 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.082365036 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.082381010 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.082405090 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.082446098 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.084733009 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.084749937 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.084794998 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.085067987 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.085114002 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.085742950 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.085758924 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.085776091 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.085791111 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.085805893 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.085807085 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.085829973 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.085876942 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.085896969 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.085922956 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.087754965 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.087796926 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.098180056 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.102998972 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.188631058 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.188652039 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.188668013 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.188785076 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.188810110 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.188863993 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.188863993 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.205046892 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.205138922 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.205152035 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.205224037 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.205240011 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.205255985 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.205427885 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.205427885 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.205885887 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.238630056 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.254442930 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.262506008 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.283508062 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:10.317156076 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:10.325404882 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:11.348675966 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:11.375344992 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:11.389004946 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:11.394887924 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:11.410551071 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:11.415445089 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:11.441768885 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:11.457602024 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:11.462518930 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:13.046101093 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:13.046101093 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:13.051029921 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:13.051039934 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:13.051047087 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:13.051055908 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:13.051105022 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:13.051112890 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:13.051172018 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:13.056094885 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:14.327884912 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:14.341835976 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:14.379270077 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:14.394877911 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:15.730643988 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:15.735826015 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:15.735929012 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:15.762239933 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:15.767538071 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:16.129806995 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:16.135242939 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:16.135320902 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:16.340233088 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:16.394891977 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:17.220590115 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:17.220690012 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:17.225577116 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.225594044 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.225608110 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.225620985 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.225635052 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:17.225766897 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.225780964 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.230515957 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.352395058 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:17.352557898 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:17.357454062 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.357492924 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.357506990 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.357521057 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.357557058 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:17.357862949 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.357918978 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.362375975 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.457498074 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:17.457567930 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:17.469109058 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.469125986 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.702764034 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:17.894892931 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:18.079399109 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:18.079803944 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:18.079870939 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:18.144104958 CEST	49744	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:18.144196987 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.144581079 CEST	49744	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:18.146225929 CEST	49744	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:18.146311045 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.610605001 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.610696077 CEST	49744	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:18.612474918 CEST	49744	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:18.612560034 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.613137007 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.689421892 CEST	49744	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:18.736510992 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.826889038 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.827032089 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.829006910 CEST	49744	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:18.831280947 CEST	49744	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:18.831280947 CEST	49744	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:18.831329107 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.831358910 CEST	443	49744	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:18.835699081 CEST	49747	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:18.835747004 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:18.835825920 CEST	49747	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:18.836847067 CEST	49747	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:18.836862087 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:19.311213970 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:19.311295986 CEST	49747	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:19.312531948 CEST	49747	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:19.312546968 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:19.313524008 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:19.322638035 CEST	49747	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:19.364557028 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:19.474834919 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:19.475101948 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:19.475162983 CEST	49747	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:19.475261927 CEST	49747	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:19.475285053 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:19.475322962 CEST	49747	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:19.475331068 CEST	443	49747	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:19.475653887 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:19.480587006 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:19.778642893 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:19.802083015 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:19.806945086 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:20.169337988 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:20.240694046 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:20.285641909 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:20.290822029 CEST	58709	49732	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:20.290880919 CEST	49732	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:20.331826925 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:20.332854033 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:20.337651014 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:20.441787004 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:20.447336912 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:20.447415113 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:23.022330046 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:23.027252913 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:23.027318954 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:23.042903900 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:23.047687054 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:23.254281044 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:23.260823011 CEST	58709	49740	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:23.260878086 CEST	49740	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:23.634453058 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:23.676106930 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:23.762183905 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:23.762386084 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:23.767185926 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:23.848853111 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:23.894870996 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:24.056416988 CEST	49753	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:24.056533098 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.057245016 CEST	49753	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:24.058163881 CEST	49753	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:24.058201075 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.521893024 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.521977901 CEST	49753	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:24.523250103 CEST	49753	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:24.523272991 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.523758888 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.565612078 CEST	49753	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:24.612494946 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.693378925 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.693798065 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.693865061 CEST	49753	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:24.693953037 CEST	49753	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:24.693995953 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.694025040 CEST	49753	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:32:24.694041967 CEST	443	49753	34.117.186.192	192.168.2.4
Jun 20, 2024 23:32:24.695296049 CEST	49755	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:24.695341110 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:24.695447922 CEST	49755	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:24.695822954 CEST	49755	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:24.695841074 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:25.168864965 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:25.168958902 CEST	49755	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:25.170284986 CEST	49755	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:25.170324087 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:25.170674086 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:25.171885967 CEST	49755	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:25.212541103 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:25.561019897 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:25.561148882 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:25.561203003 CEST	49755	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:25.561465025 CEST	49755	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:25.561491013 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:25.561515093 CEST	49755	443	192.168.2.4	104.26.4.15
Jun 20, 2024 23:32:25.561522961 CEST	443	49755	104.26.4.15	192.168.2.4
Jun 20, 2024 23:32:25.561959982 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:25.567747116 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:26.798727989 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:26.847958088 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:26.879343033 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:26.884104013 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:28.434302092 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:28.488588095 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:31.535537004 CEST	49751	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:32:31.541121006 CEST	58709	49751	77.91.77.66	192.168.2.4
Jun 20, 2024 23:32:31.541171074 CEST	49751	58709	192.168.2.4	77.91.77.66

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 23:32:06.054620981 CEST	49478	53	192.168.2.4	1.1.1.1
Jun 20, 2024 23:32:06.061911106 CEST	53	49478	1.1.1.1	192.168.2.4
Jun 20, 2024 23:32:06.710841894 CEST	64094	53	192.168.2.4	1.1.1.1
Jun 20, 2024 23:32:06.722404003 CEST	53	64094	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 20, 2024 23:32:06.054620981 CEST	192.168.2.4	1.1.1.1	0xa11b	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jun 20, 2024 23:32:06.710841894 CEST	192.168.2.4	1.1.1.1	0x4671	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 20, 2024 23:32:06.061911106 CEST	1.1.1.1	192.168.2.4	0xa11b	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Jun 20, 2024 23:32:06.722404003 CEST	1.1.1.1	192.168.2.4	0x4671	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 23:32:06.722404003 CEST	1.1.1.1	192.168.2.4	0x4671	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Jun 20, 2024 23:32:06.722404003 CEST	1.1.1.1	192.168.2.4	0x4671	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

https:

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49730	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:31:53 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-20 21:31:53 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:31:53 GMT content-type: application/json; charset=utf-8 Content-Length: 319 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:31:53 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	34.117.186.192	443	6752	C:\Users\user\Desktop\7rA1iX60wh.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:06 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:32:06 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:32:06 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:32:06 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:32:06 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	34.117.186.192	443	1364	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:06 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:32:06 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:32:06 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:32:06 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:32:06 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	34.117.186.192	443	5232	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:06 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:32:07 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:32:06 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:32:07 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:32:07 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	104.26.4.15	443	6752	C:\Users\user\Desktop\7rA1iX60wh.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:07 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:32:07 UTC	653	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:32:07 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E3E45:6510_93878F2E:0050_66749FD7_14BE2D1A:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AV3g574xEAMhx3bIyAF8x04uRXbe3AtOF%2BubLz3mDo1cu1iHmuTAHQ0uP4ONLuOAi%2FzyPNrXW9lu7WHuOskMnol9adjIqnaa8wBVpiihTffS4oWNmB54IVYShg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896edea189a40cdd-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:32:07 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:32:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	104.26.4.15	443	1364	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:07 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:32:07 UTC	655	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:32:07 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9E6D:94D6_93878F2E:0050_66749FD7_14BE2D21:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NZ65okuB%2FzM9qmKEm4wfhL2RD11qFZ3U9SeY4faA36wVc%2Fue8s0FcIZpje0n%2F2UPNg8JQKvibjusGi0N8lwsHlHFDL6Q8vtwFvPM0fwpmmmFXlivI9RA6qDt8Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896edea2cf474231-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:32:07 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:32:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49739	104.26.4.15	443	5232	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:07 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:32:07 UTC	657	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:32:07 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4672CA:DFE8_93878F2E:0050_66749FD7_14D23E82:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fdcp4drdXDtRuiMv%2FJWaPlltdLQmnPc%2FOL1ubvhTgJquaQPNDXOO%2BUEjOaHii0cYHPcXijMtoyhqP01ZnTklsFbXhd9yErD7i4OkI4D%2FjBmgYtINJsmWDgJ8WQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896edea32ebb726f-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:32:07 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:32:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	34.117.186.192	443	2004	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:18 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:32:18 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:32:18 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:32:18 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:32:18 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	104.26.4.15	443	2004	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:19 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:32:19 UTC	659	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:32:19 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9E6D:94D6_93878F2E:0050_66749FE3_14BE2ED3:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gbj%2B%2BStcNpazH%2FWLAZfAPPDfHeedSmZRcveE0lczFyV9HkU76Mx2mPLF8rEfRiqZ3MlU4fBOuT1kVQP0A%2FKm2Kw2KxaPp7cg%2BlFkNcZWHBCQg2OsZHA239iWkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896edeed4ca44228-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:32:19 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:32:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49753	34.117.186.192	443	6972	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:24 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:32:24 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:32:24 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:32:24 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:32:24 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49755	104.26.4.15	443	6972	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:32:25 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:32:25 UTC	663	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:32:25 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46E720:9860_93878F2E:0050_66749FE9_14BE2FA7:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6fyDkkiUypq%2FVLSkeC8g6%2BOsUsxtRu2lz%2FiX4L%2FxeO%2BLs8yddzY8HRuytLjRKEhr2I5EAWifqZFnlt1lys0TMPGzOUmU9Ly4rztb8WFY7v%2FtbSLi9r%2Bh2VfQYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896edf11b93c8c90-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:32:25 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:32:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:31:57
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\7rA1iX60wh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7rA1iX60wh.exe"
Imagebase:	0x400000
File size:	3'308'048 bytes
MD5 hash:	A8B80D67357AFBD703EE2A13D9CBF339
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2009861773.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1836658218.00000000057AF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1806000516.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1805883265.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1806000516.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2009458883.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2009888788.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2010729169.00000000057BB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1805883265.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1806109261.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1805522634.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1836839841.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1806109261.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:32:00
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x4b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:32:00
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:32:00
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x4b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:32:00
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:32:01
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'308'048 bytes
MD5 hash:	A8B80D67357AFBD703EE2A13D9CBF339
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.1996827426.0000000005793000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.1878445681.0000000005793000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:32:01
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'308'048 bytes
MD5 hash:	A8B80D67357AFBD703EE2A13D9CBF339
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.1984656819.0000000005770000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1983899285.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:32:11
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'308'048 bytes
MD5 hash:	A8B80D67357AFBD703EE2A13D9CBF339
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:32:16
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 1944
Imagebase:	0xe80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:32:19
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1860
Imagebase:	0xe80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:32:20
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 1904
Imagebase:	0xe80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:32:20
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'308'048 bytes
MD5 hash:	A8B80D67357AFBD703EE2A13D9CBF339
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	51.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	44

Executed Functions

Function 0040B8E0 Relevance: 65.9, APIs: 40, Instructions: 5855fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BA08
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BAD2
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040BF80
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040C47A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C575
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040C969
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040CD72
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D17B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040D29A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040D6F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D9DC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040DAD7
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040DE41
CopyFileA.KERNEL32(?,?,00000000), ref: 0040E55A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040ECF6
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040EEEA
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F45B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F525
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 004101ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00410580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0041088D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00410DC4
CopyFileA.KERNEL32(?,?,00000000), ref: 0041173C
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411904
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00411CD7
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411E6E
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411FBE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00410B14

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00410F12
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040FEF1

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040FC55

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F933

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040E6FA

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F

Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0042910D
Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00429155

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040DF3C

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED

CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D5FD

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040BB07

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040BD37
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C0CC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C196

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Directory$Create$File$Copy$Find$Cpp_errorThrow_std::_$AttributesErrorFirstLast$FolderPath___std_fs_convert_narrow_to_wide@20$CloseDeleteNextRemove
String ID:
API String ID: 1172780710-0
Opcode ID: 29938c2e1f67a8f7752316edec3deb9e51ef0fd2753200a526bf6a5ee63613ca
Instruction ID: 57087eddf2f8576e704702d152c9cc5b4e2b87ff67a8e07952ed474be97f1841
Opcode Fuzzy Hash: 29938c2e1f67a8f7752316edec3deb9e51ef0fd2753200a526bf6a5ee63613ca
Instruction Fuzzy Hash: 56F3E2B4D0425D8BDF25CF99C981AEEBBB1BF18304F1041AAD849B7341DB385A85CF69

Function 004AA200 Relevance: 56.8, APIs: 10, Strings: 11, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 004AA277

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F

Strings

X<b., xrefs: 004B0396
;Yb., xrefs: 004BAF18
Jzv", xrefs: 004BCB48
cannot use push_back() with , xrefs: 004B10BB, 004B1333, 004B3367, 004B3558, 004B8296, 004B842E, 004BDFC9, 004BE020, 004BE074, 004BFE23, 004BFFFB, 004C1CD9, 004C1E80, 004C5F5A
;Yb., xrefs: 004C47B2
WUa5, xrefs: 004BAC90
;Yb., xrefs: 004BCCC8
;Yb., xrefs: 004B26EA
;Yb., xrefs: 004B62DD
cannot use operator[] with a string argument with , xrefs: 004B14F5, 004B152D, 004B1580, 004B15B5, 004B15EC, 004B34C2, 004B3500, 004B35B5, 004B83F4, 004B848D, 004BDF6D, 004BE0D4, 004BE129, 004BE17E, 004BE1D9, 004BE22E, 004BE283, 004BE2D8, 004BE32D, 004BE382, 004BFF65, 004BFFA3, 004C0058, 004C1DEA, 004C1E28, 004C1EDD, 004C5EE8, 004C5F20, 004C5FB2
;Yb., xrefs: 004B04F0

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$Jzv"$WUa5$X<b.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-383699475
Opcode ID: 50e8e4793368ede4cbbfd3faa21feedc2e24d7a6a0abfa470dc452715c78d4b8
Instruction ID: d5c29c46e18a526762dbfc7c8aed9f945ae13eab665394adbd88e65e82b678fb
Opcode Fuzzy Hash: 50e8e4793368ede4cbbfd3faa21feedc2e24d7a6a0abfa470dc452715c78d4b8
Instruction Fuzzy Hash: 29B433B0D052698BDB25CF68C984BEEBBB1BF49304F1081DAD449A7281DB746F84CF95

Function 004D7600 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0055B192,000000FF), ref: 004D766C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 004D7693
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7959
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7CBB
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004D8DF7
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 004D9992
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA31E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DA3EF
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA712
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAA7D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DAB4E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAE39
CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 004DB0C9
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB27C
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB556
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB93C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 004DBCF1
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DBEA4
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC17E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC564
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9FB3

Part of subcall function 004DFF00: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004E0556
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E05A0

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC99C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DCAF3

Part of subcall function 004DE430: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DE49D

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9C53

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 004D9648

Part of subcall function 004DFF00: FindNextFileA.KERNEL32(00000000,?), ref: 004E056C
Part of subcall function 004DFF00: FindClose.KERNEL32(00000000), ref: 004E057C
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E0582

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004D91DD

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 004D896A

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 004D8B1D
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004D8362

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 004D8623
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D801B

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID:
API String ID: 1140557632-0
Opcode ID: 5390f64dea3d9a6db721b8f9ffaf1a58166a76a045dce46671a256603e264793
Instruction ID: 6b404ecdfd53acb60f6cf5d734e717c5294ca690171ae70fa85b8f1a38f34a58
Opcode Fuzzy Hash: 5390f64dea3d9a6db721b8f9ffaf1a58166a76a045dce46671a256603e264793
Instruction Fuzzy Hash: 76F3F2B4D0525A8BCF15CFA9C9916EEBBB0BF18304F20419AD549B7341DB346B84CFA6

Function 00490440 Relevance: 28.0, APIs: 13, Strings: 2, Instructions: 1749registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?), ref: 0049083B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0049086F
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00490895
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490A2C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490CB3
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490DA0
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490EE1
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490FCB
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 004910B5
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0049119F
RegCloseKey.ADVAPI32(?), ref: 0049229B
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 004922D1
RegCloseKey.ADVAPI32(?), ref: 004922E5

Strings

cannot use push_back() with , xrefs: 00492345
cannot use operator[] with a string argument with , xrefs: 0049239E, 004923F3

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2041898428-3306948993
Opcode ID: 70dc1500677c7a069f3ca8e8a388d3e6c552643b7932719280e578cc7331c2d8
Instruction ID: 6d5f253b48c5edfa20594e0b0a8a78ae050bf84d77acb07cc1b8e3b44561805a
Opcode Fuzzy Hash: 70dc1500677c7a069f3ca8e8a388d3e6c552643b7932719280e578cc7331c2d8
Instruction Fuzzy Hash: 511322B0C042698BDB25CF68CD84BEEBBB4BF49304F1042EAD549A7241EB756B85CF54

Function 00493F40 Relevance: 24.7, APIs: 11, Strings: 2, Instructions: 1966fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00493FA7

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

FindFirstFileA.KERNEL32(?,?), ref: 0049455F
FindNextFileA.KERNEL32(00000000,?), ref: 0049496C
FindClose.KERNEL32(00000000), ref: 0049497C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00494A53
CreateDirectoryA.KERNEL32(?,00000000), ref: 00494B19
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00494C9D

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 00494E44
CopyFileA.KERNEL32(00000000,?,00000000), ref: 004950F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00495638
CredEnumerateA.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000004), ref: 004959FD

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,0041ABA8,?,?,?,00431D09,0041ABA8,005799D8,00000000,0041ABA8), ref: 0043525B

Strings

cannot use operator[] with a string argument with , xrefs: 00496314, 0049636E
tmX, xrefs: 00493F4D

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: File$CopyCreateDirectoryFind$Cpp_errorThrow_std::_$AttributesCloseCredEnumerateErrorExceptionFirstFolderLastNextPathRaise
String ID: cannot use operator[] with a string argument with $tmX
API String ID: 2195218309-2011928656
Opcode ID: dd678a44b54076545ed104e8e989b712f5d1fef106f46798f1d704958ff365a8
Instruction ID: 1c5c2bc117abc336d538eb0f3ab0e4b698252c7f2e821ac10c87ad1798346723
Opcode Fuzzy Hash: dd678a44b54076545ed104e8e989b712f5d1fef106f46798f1d704958ff365a8
Instruction Fuzzy Hash: 0E3310B4C042698BDB25CFA8C994BEDBBB0BF18304F1041EAD849A7351EB346B85CF55

Function 00481C10 Relevance: 21.5, APIs: 7, Strings: 4, Instructions: 2202COMMON

Download Yara Rule

APIs

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 004827AB
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00482AA7
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00482DA5
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00483105
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00483433
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 00483737
Concurrency::cancel_current_task.LIBCPMT ref: 004844E1

Strings

type must be boolean, but is , xrefs: 00484507
cannot get value, xrefs: 0048445E, 00484598
cannot compare iterators of different containers, xrefs: 0048449D
type must be string, but is , xrefs: 0048455B

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: FolderPath$AttributesConcurrency::cancel_current_taskErrorFileLast
String ID: cannot compare iterators of different containers$cannot get value$type must be boolean, but is $type must be string, but is
API String ID: 1974481932-2698695959
Opcode ID: 194ef8c2ddfd07120c963886e5dc8c143c382c21f38e9d7e1e981fd7ee2d9e21
Instruction ID: 7d592af2553ac1c7978d8671279e796c0dcb22ab630186640302ddbce1f3b4fb
Opcode Fuzzy Hash: 194ef8c2ddfd07120c963886e5dc8c143c382c21f38e9d7e1e981fd7ee2d9e21
Instruction Fuzzy Hash: D74334B0C042698BDB25DF28C994BEEBBB5BF48304F1082DAD449A7281DB756F84CF55

Function 004E6770 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5
SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
DeleteFileA.KERNEL32(?), ref: 004E6AA4
FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
FindClose.KERNEL32(?), ref: 004E6ACA
GetLastError.KERNEL32 ref: 004E6AD0
SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED
RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
GetLastError.KERNEL32 ref: 004E6B20
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Strings

\*.*, xrefs: 004E6834

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: fa9544b1f4525edcf2a18f77abf6cc53c36d2fc4c8b78e4902afa25aa6e8371b
Instruction ID: d809dff945c313677263d2cc5f51936a643c350294cf92fd29307912c56e1fe7
Opcode Fuzzy Hash: fa9544b1f4525edcf2a18f77abf6cc53c36d2fc4c8b78e4902afa25aa6e8371b
Instruction Fuzzy Hash: EDD11670C00288CFDB10DFA9C9487EEBBB1FF65305F20425AE454BB292D7786A89DB55

Function 0049F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049F224
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049F322
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049F515
CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1C76

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1F5D
lstrlen.KERNEL32(?), ref: 004A348E

Strings

;Yb., xrefs: 0049FC4C
cannot use push_back() with , xrefs: 004A3518
cannot use operator[] with a string argument with , xrefs: 004A3571, 004A35C6
~]d, xrefs: 0049FAC6

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $~]d
API String ID: 2833034228-1763774129
Opcode ID: 1f0a8e9f4f1f97e1b7edb0a67155eabc9adf5731a86d5cbd02439c3b507358c4
Instruction ID: 3f98b5ef17dcfaa8f689e4fcb5a5d7fbbd5e2711f2842c60bb6495c93d0a2e70
Opcode Fuzzy Hash: 1f0a8e9f4f1f97e1b7edb0a67155eabc9adf5731a86d5cbd02439c3b507358c4
Instruction Fuzzy Hash: 2793DCB4D052A98ADB65CF29C990BEDBBB1BF59304F0081EAD84DA7241DB742BC4CF45

Function 004963B0 Relevance: 17.5, APIs: 5, Strings: 4, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00496504
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00496602
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 004967F5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498078
lstrlen.KERNEL32(?), ref: 0049854F

Strings

cannot use push_back() with , xrefs: 0049840C, 0049860E
cannot use operator[] with a string argument with , xrefs: 004985BE, 00498670
Tz}9, xrefs: 00497260
;Yb., xrefs: 004974E8

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: ;Yb.$Tz}9$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-4100205650
Opcode ID: 5e2fa55dabf0acb2d678fdf2b5874fc61568f89e3c6ed4d55f5cfcc09f9d57bb
Instruction ID: 6b3be8cf9a559e92d133cc3b6572ed682d4dab2050fd03768d9c929fe5be15d2
Opcode Fuzzy Hash: 5e2fa55dabf0acb2d678fdf2b5874fc61568f89e3c6ed4d55f5cfcc09f9d57bb
Instruction Fuzzy Hash: 352300B0D052688BDB25CF28C9947EDBBB5BF49304F1082EAE449A7281DB746BC4CF55

Function 004986B0 Relevance: 16.1, APIs: 4, Strings: 4, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00498804
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00498902
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00498AF8
lstrlen.KERNEL32(?), ref: 0049AE11

Strings

cannot use push_back() with , xrefs: 0049AD31, 0049AEBA
AN|5, xrefs: 00499560
cannot use operator[] with a string argument with , xrefs: 0049AE83, 0049AF19
;Yb., xrefs: 0049968E

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$AN|5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-1903585501
Opcode ID: f6f3a3acf082bd0a5d9ff748caf757a0c6485fd0694072b41d9b2b738c563dec
Instruction ID: e112265f5291f7fbed9e5ebb381307dd27655726dfd0f1f0b2bb5fda635101ca
Opcode Fuzzy Hash: f6f3a3acf082bd0a5d9ff748caf757a0c6485fd0694072b41d9b2b738c563dec
Instruction Fuzzy Hash: D44322B0D052688BDB25CF28C8947EEBBB5BF49304F1082EAD449A7242DB756BC4CF55

Function 0049AF60 Relevance: 14.1, APIs: 4, Strings: 3, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049B158
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049B265
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049B458
lstrlen.KERNEL32(?), ref: 0049D22D

Strings

cannot use push_back() with , xrefs: 0049D0EA, 0049D2EC
;Yb., xrefs: 0049BFEE
cannot use operator[] with a string argument with , xrefs: 0049D29C, 0049D353

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-747751661
Opcode ID: 9e0cfae2292340650dd180be020e1692664da05a1eb25defc7f8f7f2b803398a
Instruction ID: b2dbe3f5757ef5304a2bca7f4d9e3a7c922558eb406562d1b13ccbd165419304
Opcode Fuzzy Hash: 9e0cfae2292340650dd180be020e1692664da05a1eb25defc7f8f7f2b803398a
Instruction Fuzzy Hash: BF2321B0D042688BDB25CF28C9947EDBBB1BF59304F1082EAE449A7281DB746BC4CF55

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
FreeAddrInfoW.WS2_32(?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
FreeAddrInfoW.WS2_32(?), ref: 004C86A5

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 0049D3A0 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049D4F4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049D5F2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049D7E5
lstrlen.KERNEL32(?), ref: 0049EF32

Strings

cannot use push_back() with , xrefs: 0049EE76, 0049F02B
cannot use operator[] with a string argument with , xrefs: 0049EF9D, 0049EFDB, 0049F08D

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: c6cbefe6cdfd718c914dfa6f95648d9804452b726278078694caf46b48fbcca4
Instruction ID: d38aed82ee4788d52106214de1412b854dd9129e0c255bb6c7140376d04d8967
Opcode Fuzzy Hash: c6cbefe6cdfd718c914dfa6f95648d9804452b726278078694caf46b48fbcca4
Instruction Fuzzy Hash: 570334B0D042688BDB25CF28C9947EEBBB4BF59304F1042EED449A7281EB746B84CF55

Function 004C6D80 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 535
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004C7051

Part of subcall function 00432534: __EH_prolog3.LIBCMT ref: 00432570

std::_Throw_Cpp_error.LIBCPMT ref: 004C7062

Part of subcall function 004E74C0: __fread_nolock.LIBCMT ref: 004E7609

DeleteFileA.KERNELBASE(?), ref: 004C70EB

Strings

131, xrefs: 004C7135, 004C714E
binga, xrefs: 004C7171, 004C718A

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$binga
API String ID: 3880692912-2981407559
Opcode ID: 1d3039ac34b0bace3428b3acdb5220c0de971d4708e8a6c219af6cb8fbb17908
Instruction ID: 7966019704e3fd473910eda9b3190c6326d4c2da0caac65bea49cbac806563d6
Opcode Fuzzy Hash: 1d3039ac34b0bace3428b3acdb5220c0de971d4708e8a6c219af6cb8fbb17908
Instruction Fuzzy Hash: 1E32ACB4D04248CFCB04DFA8C985BAEBBB1BF58304F14419EE8056B392D779AA45CF95

Function 004FAD00 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RTRIM, xrefs: 004FAF68
MATCH, xrefs: 004FB108, 004FB119, 004FB139, 004FB13A, 004FB150
NOCASE, xrefs: 004FB02A
automatic extension loading failed: %s, xrefs: 004FB22C
sqlite_rename_table, xrefs: 004FB0E4
BINARY, xrefs: 004FAF25, 004FAF34, 004FAF4E, 004FAF8E, 004FAF99, 004FAFB1, 004FB003, 004FB004
no such vfs: %s, xrefs: 004FAEB7

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: 86b60c77fac7b795ac9b7615c1f9e16c37b5b525381de673a4f5b77e4c01622b
Instruction ID: 5912c9be0b5fe0253428befa1510005b8e6d21b15bd6994098c8da1f87b2af15
Opcode Fuzzy Hash: 86b60c77fac7b795ac9b7615c1f9e16c37b5b525381de673a4f5b77e4c01622b
Instruction Fuzzy Hash: 510258B0A007089BEB209F15DC4577B7BE4EF51304F14442EEA4A9B391EBB9E944CBC6

Function 004DF030 Relevance: 8.4, APIs: 5, Instructions: 876
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DF09A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF329

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF52A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF84A

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DFC7D

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID:
API String ID: 2127212259-0
Opcode ID: 2482f94120ed5ea93039516545623d95f61e970846a000b1fcdf438d4bcd209a
Instruction ID: 8e27dc709fe3b7ff7b62f4d1f71842afe3ac2492894b6e8ccfd466f18f63ab33
Opcode Fuzzy Hash: 2482f94120ed5ea93039516545623d95f61e970846a000b1fcdf438d4bcd209a
Instruction Fuzzy Hash: DBA202B4D0425D8BDF25CFA8C995AEEBBB0BF18304F2041AAD949B7351D7341A84CFA5

Function 004DE430 Relevance: 8.2, APIs: 5, Instructions: 731
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DE49D

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DE8C9
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DEA83
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DED11
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DEE67

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID:
API String ID: 1001086254-0
Opcode ID: 26680b1becdb41978357c0f33f45d202fe4b356215f4adaeaf7733656648b968
Instruction ID: 4de69712ac24b7a09e9bc2c7d11d42553b755471a164b72fa8c1d2b7ead1c118
Opcode Fuzzy Hash: 26680b1becdb41978357c0f33f45d202fe4b356215f4adaeaf7733656648b968
Instruction Fuzzy Hash: 298225B0C042598BCB15CFA9C995BEEBBB0BF18304F10419ED549BB382DB745A85CFA5

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F
FindNextFileA.KERNELBASE(00000000,00000010), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: 90cf4eca11af66bb089fdb4a1b4223e767fc84b405f6936ed3c5d03910aaf901
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: 90cf4eca11af66bb089fdb4a1b4223e767fc84b405f6936ed3c5d03910aaf901
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 004C6B00 Relevance: 4.7, APIs: 3, Instructions: 206encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004C6B57
LocalFree.KERNEL32(?), ref: 004C6B86
LocalFree.KERNEL32(?), ref: 004C6C82

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: 6647244c26512a52de21afd46b75caebb72f7fadd5b90fb549dccdfd3791c3cc
Instruction ID: 6019ec204b0dd747d4126109e6a4f8e7bf51aa55734569d67b400ef60c6c0d13
Opcode Fuzzy Hash: 6647244c26512a52de21afd46b75caebb72f7fadd5b90fb549dccdfd3791c3cc
Instruction Fuzzy Hash: 6171B171C002489BDB00DFA8C945BEEFBB4EF14314F10826EE851B3391EB786A44DBA5

Function 0053F550 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053F705
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053FA07

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 7cc4ef92f3a6051046a18418b77ea2a3a6de1ed4712a7747bb821a5c40650b69
Instruction ID: 1f76d2344d35fe0e13097961589cbfb84b6978ae6f877586e2245b879765d82e
Opcode Fuzzy Hash: 7cc4ef92f3a6051046a18418b77ea2a3a6de1ed4712a7747bb821a5c40650b69
Instruction Fuzzy Hash: E3029C71A04702AFDB18CF29C840B6ABBE4BF88318F14867DE859D7650D774ED94CB92

Function 0044002D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b15aa9a463d604c256c669c29f6134746f95fa67f9ccc3a2b131056c85d33937
Instruction ID: 127d1e6b524efbadbaaaff55744b8fab0cc6e196c82b7e7b6ae44d0b7ee8643f
Opcode Fuzzy Hash: b15aa9a463d604c256c669c29f6134746f95fa67f9ccc3a2b131056c85d33937
Instruction Fuzzy Hash: 3BB1F67090060A9BFB28CE68D855ABFBBB1AF04304F140A1FDA52A7791C77D9D21CB59

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(0000036C,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Part of subcall function 004C8590: WSAStartup.WS2_32 ref: 004C85BA
Part of subcall function 004C8590: getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
Part of subcall function 004C8590: socket.WS2_32(?,?,?), ref: 004C865D
Part of subcall function 004C8590: connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
Part of subcall function 004C8590: closesocket.WS2_32(00000000), ref: 004C867D
Part of subcall function 004C8590: FreeAddrInfoW.WS2_32(?), ref: 004C868A
Part of subcall function 004C8590: WSACleanup.WS2_32 ref: 004C8690

recv.WS2_32(?,00000004,00000008), ref: 004C7E23
__Xtime_get_ticks.LIBCPMT ref: 004C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004C7EB9

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: 22b059c2bf6a44bc48976c4274571e0fd76720a3154fb2fdee491ad85608cae8
Instruction ID: b3d54dcccad81d83ab75f13ba9899d4b50e1d8608cabcccfb3508871926cac68
Opcode Fuzzy Hash: 22b059c2bf6a44bc48976c4274571e0fd76720a3154fb2fdee491ad85608cae8
Instruction Fuzzy Hash: 9EB1AC71D043089BEB10DBA8CC49BAEBBB1BB54314F24025EE815BB2D2D7785D88DF95

Function 0045E140 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045E3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045E4C6
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0045E808
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045EB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045EC10

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045ED06

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045EDED
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045F06D

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: bd257381b72f24b865c35424aca81356a138dcccbec74b51b3f8208da1a3af36
Instruction ID: 0e418cf523baa0a35c0a910b93c4bb77d5942d6061cfe1063ad62b245a56bb8b
Opcode Fuzzy Hash: bd257381b72f24b865c35424aca81356a138dcccbec74b51b3f8208da1a3af36
Instruction Fuzzy Hash: 4FA226B0D012688BCB25DB65CD95BDDBBB4AF14304F0040EED44A67282EB785F88DF5A

Function 004E4720 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 004E4A70
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 004E4ADC
LsaOpenPolicy.ADVAPI32(00000000,00587684,00000001,?), ref: 004E4B35
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 004E4B48
LsaFreeMemory.ADVAPI32(?), ref: 004E4B76
LsaClose.ADVAPI32(?), ref: 004E4B7F

Strings

%wZ, xrefs: 004E4B65
&"N, xrefs: 004E472D
;Yb., xrefs: 004E49C7

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$&"N$;Yb.
API String ID: 762890658-4094109456
Opcode ID: 71ef275a8d6462c4c5fc6e537bb68741ac7498f384360e828531ccc0aa0ebddd
Instruction ID: db120a3af714b361d6db134a28a940fef9e0d4b71911d12d67c4190411436b99
Opcode Fuzzy Hash: 71ef275a8d6462c4c5fc6e537bb68741ac7498f384360e828531ccc0aa0ebddd
Instruction Fuzzy Hash: 1EE101B4D0425A8FDB14CF98C985BEEBBB4BF08304F2041AAE949B7341D7745A85CFA5

Function 00448910 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ebc92e5ca6f275d4bbb75147d6ad3a24cc47560e82a7b4de6b8652cd53fa6b
Instruction ID: d4d7462daa34083545f9d93f0c5ebf53bf58a01a885379ada905c47cec286c1a
Opcode Fuzzy Hash: f0ebc92e5ca6f275d4bbb75147d6ad3a24cc47560e82a7b4de6b8652cd53fa6b
Instruction Fuzzy Hash: E2B1F4B0A00245AFFB11DF99C881BAE7BB1FF55304F14015EE414AB392CB78AD81CB69

Function 004D6BA0 Relevance: 9.2, APIs: 6, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
6CE47CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50
SetLastError.KERNEL32(00000000), ref: 004D6CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D25
GetLastError.KERNEL32(?,?,00000000), ref: 004D6D33
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D47

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: ErrorLast$CopyFile
String ID:
API String ID: 936320341-0
Opcode ID: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction ID: cca443e56f4e81c83c2dc89493b37bcb85ee1d7da0cfa031959f485395bd6110
Opcode Fuzzy Hash: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction Fuzzy Hash: 6051C172D01219ABCB21CF94DC55BEEBBB8EB04320F10026AE804B3390D7396E05CBA4

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 774b9c4b9187c83634f0aff28f756a2d2202c529353b41c2e594352841e16a85
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: 774b9c4b9187c83634f0aff28f756a2d2202c529353b41c2e594352841e16a85
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 00463830 Relevance: 6.9, APIs: 3, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6C10: CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004E6C55

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00465CB0
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00465FD5

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00465EC6

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: c1b21f399d309448afd63e0aa7f7554c44f6e0905c5994cb67049cb66184fefb
Instruction ID: bdb7de5e538d98cc2bc1e856d074b668cb5d4ba5ca64421d2565693f44b24664
Opcode Fuzzy Hash: c1b21f399d309448afd63e0aa7f7554c44f6e0905c5994cb67049cb66184fefb
Instruction Fuzzy Hash: 8053CFB0D052688FDB65DF55C994BDDBBB0BB58304F0041EAD44AA7292EB382F84DF49

Function 004E6CA0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 65662f257d92aefc3507c5f8cb9ddc555297535a90f0ce1970463870aaf9e219
Instruction ID: 241e2f942859b358e1133ab4bf22632851a161ac9c5554c12c2f2fb0b7350d8e
Opcode Fuzzy Hash: 65662f257d92aefc3507c5f8cb9ddc555297535a90f0ce1970463870aaf9e219
Instruction Fuzzy Hash: DF11CE71A0028496DB205F6A5C08F6A7F60EB22772F64031BD8359B3D4DB3948058759

Function 004D6790 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 004D6A20

Part of subcall function 004D6BA0: GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
Part of subcall function 004D6BA0: 6CE47CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50

std::_Throw_Cpp_error.LIBCPMT ref: 004D6B84
std::_Throw_Cpp_error.LIBCPMT ref: 004D6B95

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyErrorFileLast
String ID:
API String ID: 1723067277-0
Opcode ID: 9fad268e1b32fb5342daa8b04bbb0199fc585924ca8808c03fe502974afbaa59
Instruction ID: af59b977606615079acd7a310a8afa41bd250120d803ccb4a837ad8b48953fd5
Opcode Fuzzy Hash: 9fad268e1b32fb5342daa8b04bbb0199fc585924ca8808c03fe502974afbaa59
Instruction Fuzzy Hash: 5BD18BB0C00249DBDB04DFA9C9557EEBBB1BF54304F14419ED80577382EB785A45CBA6

Function 00493B60 Relevance: 4.8, APIs: 3, Instructions: 264registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 00493D89
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?), ref: 00493DAC
RegCloseKey.ADVAPI32(?), ref: 00493DB7

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 77d91e2ffbc41f4e718118182c7f4e60994b52f51d4fd49462c42fe523481256
Instruction ID: c2861601c7c989816088ca7cd521e7ac3defefe444e22908af63c5fcea44e6b0
Opcode Fuzzy Hash: 77d91e2ffbc41f4e718118182c7f4e60994b52f51d4fd49462c42fe523481256
Instruction Fuzzy Hash: C8C136B1D042499FDB14CFA8D986BAEBBB0EF09314F204169E905B7391E7345A84CFA5

Function 004E6C10 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004E6C55

Part of subcall function 00432BAA: RtlReleaseSRWLockExclusive.NTDLL(004E6D30), ref: 00432BBE

std::_Throw_Cpp_error.LIBCPMT ref: 004E6C84
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C95

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 1369faf54573f1097b34743c1b99fafbb3d15d6b7359fe2f2678d7eae3eda35f
Instruction ID: b54f6e02dbe68d52aaf8ce57ceccae370b453a77f91dfdb3bbc81736346272f4
Opcode Fuzzy Hash: 1369faf54573f1097b34743c1b99fafbb3d15d6b7359fe2f2678d7eae3eda35f
Instruction Fuzzy Hash: B2F049B1500640FBD7109F999D06B6ABBA8FB05731F14031AFC35A63D0D7B5190087AA

Function 0044B9D0 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,0043D2B1,?), ref: 0044B9D8
GetLastError.KERNEL32(?,0043D2B1,?), ref: 0044B9E2
__dosmaperr.LIBCMT ref: 0044B9E9

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 09b3d7d03d43d7566e94fc4839c3f2f0e9d57db1a11ed26f70a1bc8201ac59e9
Instruction ID: 29a5b21677c8caf908dcad016bfb5ae84cbfd6cad116b975ceede8be2d8f2443
Opcode Fuzzy Hash: 09b3d7d03d43d7566e94fc4839c3f2f0e9d57db1a11ed26f70a1bc8201ac59e9
Instruction Fuzzy Hash: 00D0C9321146086BEA106BB6BC089163B6D9A913797140616F52CC52A0EE25C895A665

Function 004E57F0 Relevance: 3.4, APIs: 2, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004E588F
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004E5B9B

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: 0a0dcd09eef47cc32d5847b2942677d40245ae2126d3bdebcd0edae20a9bad6e
Instruction ID: 009fea26e280c08ebde66711631a2368a09a7ac58c7b38572a32fddf838a6e16
Opcode Fuzzy Hash: 0a0dcd09eef47cc32d5847b2942677d40245ae2126d3bdebcd0edae20a9bad6e
Instruction Fuzzy Hash: 81F157B0D002499BDB14CFA8C9957EEBBB1FF08304F24425EE545BB381DB756A84CBA5

Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00448E9F: GetConsoleOutputCP.KERNEL32(0B60023A,00000000,00000000,0043D0C7), ref: 00448F02

WriteFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,?,004E6E3C,?,0043CFE7,004E6E3C,?,00579E10,00000010,0043D0C7), ref: 0044990E
GetLastError.KERNEL32(?,0043CFE7,004E6E3C,?,00579E10,00000010,0043D0C7,004E6E3C,?,00000000,?), ref: 00449918

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 31457cb41688bf9267a4d34aaba0591c787e78cc82baf2098e7bb743f7a0da0b
Instruction ID: 4c198159cf300fc4e9085a349e24ad4d45033eb13303bb4f9288eddf9455663d
Opcode Fuzzy Hash: 31457cb41688bf9267a4d34aaba0591c787e78cc82baf2098e7bb743f7a0da0b
Instruction Fuzzy Hash: 9961C5B1C14119BFEF11DFA8C844AAFBBB9AF49304F14014AE800A7316D739DD05EB65

Function 004D65F0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D676A
std::_Throw_Cpp_error.LIBCPMT ref: 004D677B

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: ee00d86a89ee62715d60b896044e90f690cda42d917c0ef1e64fc9d0a964cb8a
Instruction ID: 177bb7d1701b8dda1f5a90c4ee3be826f8175b366ab48e47effb054e9b4aa952
Opcode Fuzzy Hash: ee00d86a89ee62715d60b896044e90f690cda42d917c0ef1e64fc9d0a964cb8a
Instruction Fuzzy Hash: 6441F2B1E002058BC720DF68995136EBBA1BB94314F19072FE815673D1EB79EA04C795

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E5F

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,0043D0C7,00000000,00000002,00000000,00000000,00000000,00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000), ref: 00442558
GetLastError.KERNEL32(00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000,?,0044982E,00000000,00000000,00000000,00000002,0043D0C7,00000000), ref: 00442565

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 0044B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B030
GetLastError.KERNEL32(?,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B03B

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction ID: f233056e1464041c82b2d36bf1c88bdb576215b3e64377b8de55bab97aefa9e3
Opcode Fuzzy Hash: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction Fuzzy Hash: 66E08C32100204ABEB212FA5AC0CB9A3B69EF00756F15802AF608971B0DB38C894D798

Function 004C7EF0 Relevance: 1.9, APIs: 1, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ad1d256c0ddfb69c72597b5609d37edd2aee79e43187298c3c7066527089eb
Instruction ID: 65307ecbef6fb9e01e3d4ad067897c34c173f6a72c2a6aa1ef5fcaa49911cde8
Opcode Fuzzy Hash: 98ad1d256c0ddfb69c72597b5609d37edd2aee79e43187298c3c7066527089eb
Instruction Fuzzy Hash: 0E02A070D04248DFDB14DF68C945BDDBBB0AB14308F14419ED8057B386EBB95E88DB9A

Function 00413D50 Relevance: 1.8, APIs: 1, Instructions: 253COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00414093

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 292ee55504a0c84bc4dce0c46bca906e9555851c0c64a8d595c00ed0b9889e27
Instruction ID: 20828e305faf8902bc30eee05bf9285b15bc31f2c0f4ddd4d11a1ed2060bf189
Opcode Fuzzy Hash: 292ee55504a0c84bc4dce0c46bca906e9555851c0c64a8d595c00ed0b9889e27
Instruction Fuzzy Hash: 21C138B0901249DFDB00CFA9C444799FBF0AF49314F28C1AEE458AB391D77A9A45CF95

Function 00415350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0041546E

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d8e0c2d8605fadc367f8379d6fda68e220b434a80e24b35f09aa55ac94478e6c
Instruction ID: bd448271620100f3a1b1b6e8090fbb17c8ec551eb96fe3ea9a7077eb077db61a
Opcode Fuzzy Hash: d8e0c2d8605fadc367f8379d6fda68e220b434a80e24b35f09aa55ac94478e6c
Instruction Fuzzy Hash: AF6199B1A00614DFCB10CF59C984B9ABBF5FF88310F24816EE8199B391C778EA41CB95

Function 00423800 Relevance: 1.7, APIs: 1, Instructions: 174COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004239F6

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0b30ede6d2177858bd02f28407913f6a139226577b0ddbf2f8e8131ed222de7e
Instruction ID: ae0d64c3ee62d8e2c2672323fae3dbdcf3c597174b0ef38ce080d0ce73c77a4b
Opcode Fuzzy Hash: 0b30ede6d2177858bd02f28407913f6a139226577b0ddbf2f8e8131ed222de7e
Instruction Fuzzy Hash: 7E51D671B001149FCB04EF68DD82A6EBBB5AB48304F54462EF801EB3D1DB78AA44CB95

Function 00438E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0750673b6008633cc79045623eaeb207d83782e0e9d8302f40567207ba640ce
Instruction ID: 9663080612542d3e5f9b84a36c3ecf1ef98ea00319430370267f097460dfd66c
Opcode Fuzzy Hash: e0750673b6008633cc79045623eaeb207d83782e0e9d8302f40567207ba640ce
Instruction Fuzzy Hash: 2651C670A00204AFDF14DF59C881AAABBA2EF8D328F24915EF8089B352D775DD41CB55

Function 00429E20 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00429F7B

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8482c0d6c957f33918d9138d1bd6797b8604ed2ab317032aa5cc83da2685a5d5
Instruction ID: efe4cd6a287aa12a83b409d23e88dd93d6c4865ddef84cf0d949cd52fc0f7608
Opcode Fuzzy Hash: 8482c0d6c957f33918d9138d1bd6797b8604ed2ab317032aa5cc83da2685a5d5
Instruction Fuzzy Hash: AA410271E001259FCB14DF68C9419AEBBB9EB89310F64422EE815E7381D738DE01CBE4

Function 004E7640 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E77AC

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 197287f306943a7eaf2b7af720c5d2f6f148b8bd07183e9c25995d5497f4cfff
Instruction ID: 028c77ef4637c0ac0bfd58be9ca2c186fed01019b569c5d695070078eed700b9
Opcode Fuzzy Hash: 197287f306943a7eaf2b7af720c5d2f6f148b8bd07183e9c25995d5497f4cfff
Instruction Fuzzy Hash: A8517FB0D043499BDB10DF99D986BAEFBB4FF44714F10012EE8416B381D7796A44CBA5

Function 004E74C0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E7609

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 0af5f4a60814f08790e3d5c9fcafef44908044cc60dbeb0b5656bde3db2df168
Instruction ID: 959dba962c579710b3c8227977385e6342f185642bc3a86ace1f34c607c4467c
Opcode Fuzzy Hash: 0af5f4a60814f08790e3d5c9fcafef44908044cc60dbeb0b5656bde3db2df168
Instruction Fuzzy Hash: 78416CB0D04248EBDB14DF99D985BEEBBB4FF48714F10416EE801AB381D7799901CBA5

Function 00406870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00406908

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: c3b8b3600ed0ad07f9a4110fed077291c3700e835e34d0cb827fcc3074b6ad22
Instruction ID: 382a6ddcba4688358f9e0a4ad0208e6a3358ad319658d54a7c18dfc33c73484c
Opcode Fuzzy Hash: c3b8b3600ed0ad07f9a4110fed077291c3700e835e34d0cb827fcc3074b6ad22
Instruction Fuzzy Hash: AB21AE76E00619ABCB14EF49D841BAAB7B4FB84324F00466EED1663780DB396D10CB94

Function 004E5D00 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(0055D560,00000000,00000000), ref: 004E5D47

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction ID: 3af1858aaf6aa964ebdd9f4359c5c99147492c850a3065a18f0c0dee6211d041
Opcode Fuzzy Hash: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction Fuzzy Hash: A0110EB1D04B449BE3208F28DD0A757BBF0EB00B28F10471EE850573C1E3BA6A4887E2

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044A65A Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,000000FF,00000000), ref: 0044A69B

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 44fe68ec2fca24d705c4288583a30094579fd4d4051ae38cb78614132530c581
Instruction ID: 9689b7dccde3e7d2c1426315cc49502dff6dd5535dcc2f3da2dc3831567fdc71
Opcode Fuzzy Hash: 44fe68ec2fca24d705c4288583a30094579fd4d4051ae38cb78614132530c581
Instruction Fuzzy Hash: 4CF0E0311905246BFB216A66DC05B5B375CAF41760F1E8117EC84EB190CA3CDC3146EE

Function 00406840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406853

Part of subcall function 00431F7B: FindNextFileW.KERNELBASE(?,?,?,00406858,?,?,?,?,0040691A,?,?,?,00000000,?,?), ref: 00431F84

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction ID: f155dccb83496c4d8f98fbb14974b26749813e83e467fdfa34ea523ab42003ff
Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction Fuzzy Hash: 63D05E22701520118D24752738085AF06498DC66A8A42447FB84AB32C2EA2D8C0311AD

Function 004466D5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004466DC

Memory Dump Source

Source File: 00000000.00000002.2007848217.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007817904.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007973463.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008013177.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008044442.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008072531.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000751000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000753000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000755000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000759000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000760000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000076E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000776000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000077C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000784000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.000000000078A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2008102325.00000000007B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2009017637.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7rA1iX60wh.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction ID: ccf5b3b5ee64302dd7184922bc8d264c22512182c10063c293431932d1ea205a
Opcode Fuzzy Hash: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction Fuzzy Hash: 13E09AB2C0020D9ADB00DFD5C452BEFBBB8AB08315F50446BA205E6181EB789748CBE5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7rA1iX60wh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7rA1iX60wh.exe_511ab0be63976828f72d7f6d2841b4c9b261a31_cf8b7adb_4ffa0061-89aa-4a4c-b409-95594dce7fb0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_a06fe7d5e939aa5857c5d2fe9ff4c2a9e77a88_f4fd270f_bb4cd91d-df8c-4f38-905d-2e89817ed0fa\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_a06fe7d5e939aa5857c5d2fe9ff4c2a9e77a88_f4fd270f_c3495008-d89e-4544-998b-0fae7661c62b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2225.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER239D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23CD.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F83.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER31F5.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3225.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3242.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER332E.tmp.WERInternalMetadata.xml

Windows Analysis Report
7rA1iX60wh.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre