Edit tour

Windows Analysis Report
plTAoSCew2.exe

Overview

General Information

Sample name:	plTAoSCew2.exe renamed because original name is a hash value
Original sample name:	ad7b4598918c9f75bcad2d3837abc47e.exe
Analysis ID:	1460407
MD5:	ad7b4598918c9f75bcad2d3837abc47e
SHA1:	c216e887a2559bc45f4b75d8f97e8d2450f16213
SHA256:	d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6
Tags:	exeRiseProStealer
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

plTAoSCew2.exe (PID: 432 cmdline: "C:\Users\user\Desktop\plTAoSCew2.exe" MD5: AD7B4598918C9F75BCAD2D3837ABC47E)

schtasks.exe (PID: 1072 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1236 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7372 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1920 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 1068 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: AD7B4598918C9F75BCAD2D3837ABC47E)

WerFault.exe (PID: 7464 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1876 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 6288 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: AD7B4598918C9F75BCAD2D3837ABC47E)

WerFault.exe (PID: 7512 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6288 -s 1744 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 7396 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: AD7B4598918C9F75BCAD2D3837ABC47E)

RageMP131.exe (PID: 7840 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: AD7B4598918C9F75BCAD2D3837ABC47E)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\RRyR9q5fccm7OnjvPC2dXYR.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\i6XbcxN8dLmuU_sWPwGcEWP.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000003.1817420453.00000000056E4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000003.1786962093.00000000056E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000003.1786825043.00000000056E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000006.00000002.1951132632.0000000000D26000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000002.1939291540.00000000056E4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000002.1939291540.000000000568C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.1786572125.00000000056E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: plTAoSCew2.exe PID: 432	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: plTAoSCew2.exe PID: 432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 1068	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 1068	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6288	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6288	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7396	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7840	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\plTAoSCew2.exe, ProcessId: 432, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-23:37:06.459517
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-23:36:58.414569
SID:	2049060
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:37:20.478810
SID:	2046266
Source Port:	58709
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-23:37:07.984285
SID:	2046269
Source Port:	49734
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:37:12.469216
SID:	2046266
Source Port:	58709
Destination Port:	49742
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:37:01.576649
SID:	2046266
Source Port:	58709
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-23:37:23.984675
SID:	2046269
Source Port:	49754
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:36:59.610617
SID:	2046266
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:37:01.475795
SID:	2046266
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 77.91.77.66

Timestamp:	06/20/24-23:37:07.937383
SID:	2046269
Source Port:	49733
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:36:59.830397
SID:	2046267
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:37:01.695305
SID:	2046267
Source Port:	58709
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-23:37:01.804652
SID:	2046267
Source Port:	58709
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://77.91.77.81/mine/amadka.exe	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/go.exe	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exe.1	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exeP	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exeisepro_bot	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe963	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe00.1	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 51%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: plTAoSCew2.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_004C6B00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		5_2_004C6B00

Source: plTAoSCew2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49757 version: TLS 1.2

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_00493F40
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004938D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	5_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004938D0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49731 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49734
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.4:49734
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49731 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49733 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49734 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49742
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.4:49754
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49754 -> 77.91.77.66:58709

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 77.91.77.66 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 77.91.77.66:58709

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 104.26.5.15 104.26.5.15
Source: Joe Sandbox View	IP Address: 77.91.77.66 77.91.77.66

Source: Joe Sandbox View

ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Code function: 0_2_004C8590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,FreeAddrInfoW,WSACleanup,FreeAddrInfoW,

0_2_004C8590

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1939291540.00000000056BD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1952431025.00000000057FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exeP
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe00.1
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe963
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exeisepro_bot
Source: MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe.1
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: plTAoSCew2.exe, 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmp, plTAoSCew2.exe, 00000000.00000003.1666366479.00000000028B0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938053535.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1698887764.00000000028D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1699835133.00000000028E0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1950317365.000000000055D000.00000002.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000A.00000002.1885484407.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000000A.00000003.1809231647.0000000000F30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1978107084.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000011.00000003.1889498144.0000000000F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.000000000106F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/6
Source: RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001065000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33U
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33XB
Source: RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33tA
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/i
Source: MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/u
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/z
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33J
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001010000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000104D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Grr
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951132632.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001026000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000104D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Wp
Source: plTAoSCew2.exe, 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmp, plTAoSCew2.exe, 00000000.00000003.1666366479.00000000028B0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938053535.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1698887764.00000000028D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1699835133.00000000028E0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1950317365.000000000055D000.00000002.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000A.00000002.1885484407.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000000A.00000003.1809231647.0000000000F30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1978107084.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000011.00000003.1889498144.0000000000F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/p
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/t
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951132632.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000102E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33P
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33V0
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33e
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33o
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951132632.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001026000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000104D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: plTAoSCew2.exe, 00000000.00000003.1746011314.0000000005817000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1748770290.0000000005838000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775059834.0000000005700000.00000004.00000020.00020000.00000000.sdmp, tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: plTAoSCew2.exe, 00000000.00000003.1746011314.0000000005817000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1748770290.0000000005838000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775059834.0000000005700000.00000004.00000020.00020000.00000000.sdmp, tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.5F
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.H
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, RRyR9q5fccm7OnjvPC2dXYR.zip.5.dr, i6XbcxN8dLmuU_sWPwGcEWP.zip.0.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT-n
Source: MPGPH131.exe, 00000005.00000002.1939291540.000000000568C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT4
Source: plTAoSCew2.exe, 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTZ
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.5.dr, passwords.txt.0.dr	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.46.123.33
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botJ
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botQB
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botX
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: plTAoSCew2.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1758383046.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1952431025.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1758383046.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/EH
Source: plTAoSCew2.exe, 00000000.00000003.1748032372.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745823071.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1746837254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747439986.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1773502573.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1773782077.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1939291540.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769017495.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771529992.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1772016615.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.5.dr, 3b6N2Xdh3CYwplaces.sqlite.5.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1758383046.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1952431025.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: plTAoSCew2.exe, 00000000.00000003.1748032372.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745823071.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1746837254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747439986.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1773502573.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1773782077.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1939291540.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769017495.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771529992.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1772016615.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1952431025.0000000005812000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771375415.0000000005812000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.5.dr, 3b6N2Xdh3CYwplaces.sqlite.5.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/r
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refoxe
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refoxmChE5

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49757 version: TLS 1.2

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Code function: 0_2_004E5FF0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,735274A0,DeleteObject,DeleteObject,ReleaseDC,

0_2_004E5FF0

System Summary

PE file contains section with special chars

Source: plTAoSCew2.exe	Static PE information: section name:
Source: plTAoSCew2.exe	Static PE information: section name:
Source: plTAoSCew2.exe	Static PE information: section name:
Source: plTAoSCew2.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0044002D	0_2_0044002D
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004DF030	0_2_004DF030
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0049F0D0	0_2_0049F0D0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004AA200	0_2_004AA200
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0049D3A0	0_2_0049D3A0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004963B0	0_2_004963B0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00490440	0_2_00490440
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004DE430	0_2_004DE430
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0053F550	0_2_0053F550
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004D7600	0_2_004D7600
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004986B0	0_2_004986B0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0040B8E0	0_2_0040B8E0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00481C10	0_2_00481C10
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004FAD00	0_2_004FAD00
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00493F40	0_2_00493F40
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0049AF60	0_2_0049AF60
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004DFF00	0_2_004DFF00
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00493080	0_2_00493080
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004371A0	0_2_004371A0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0044036F	0_2_0044036F
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004A4320	0_2_004A4320
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004845E0	0_2_004845E0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0042F580	0_2_0042F580
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004A3610	0_2_004A3610
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_005486C0	0_2_005486C0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00547760	0_2_00547760
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004E77E0	0_2_004E77E0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004547BF	0_2_004547BF
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0043C960	0_2_0043C960
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0043A928	0_2_0043A928
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0044DA86	0_2_0044DA86
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00458BB0	0_2_00458BB0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004EEC40	0_2_004EEC40
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004EFC40	0_2_004EFC40
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00534D40	0_2_00534D40
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00546D20	0_2_00546D20
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00545DE0	0_2_00545DE0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00458E30	0_2_00458E30
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00541F00	0_2_00541F00
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004F2FD0	0_2_004F2FD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044002D	5_2_0044002D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DF030	5_2_004DF030
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0049F0D0	5_2_0049F0D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004AA200	5_2_004AA200
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0049D3A0	5_2_0049D3A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004963B0	5_2_004963B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00490440	5_2_00490440
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DE430	5_2_004DE430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0053F550	5_2_0053F550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004D7600	5_2_004D7600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004986B0	5_2_004986B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0040B8E0	5_2_0040B8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00481C10	5_2_00481C10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004FAD00	5_2_004FAD00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40	5_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0049AF60	5_2_0049AF60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DFF00	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493080	5_2_00493080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004371A0	5_2_004371A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044036F	5_2_0044036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004A4320	5_2_004A4320
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004845E0	5_2_004845E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0042F580	5_2_0042F580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004A3610	5_2_004A3610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_005486C0	5_2_005486C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00547760	5_2_00547760
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004E77E0	5_2_004E77E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004547BF	5_2_004547BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043C960	5_2_0043C960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043A928	5_2_0043A928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0044DA86	5_2_0044DA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00458BB0	5_2_00458BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004EEC40	5_2_004EEC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004EFC40	5_2_004EFC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00534D40	5_2_00534D40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00546D20	5_2_00546D20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00545DE0	5_2_00545DE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00458E30	5_2_00458E30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00541F00	5_2_00541F00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004F2FD0	5_2_004F2FD0

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0041ACE0 appears 86 times
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: String function: 0041ACE0 appears 86 times

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1920

Source: plTAoSCew2.exe	Binary or memory string: OriginalFilename vs plTAoSCew2.exe
Source: plTAoSCew2.exe, 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs plTAoSCew2.exe
Source: plTAoSCew2.exe, 00000000.00000000.1664463109.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs plTAoSCew2.exe
Source: plTAoSCew2.exe	Binary or memory string: OriginalFilenamedotnet.exe6 vs plTAoSCew2.exe

Source: plTAoSCew2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: plTAoSCew2.exe	Static PE information: Section: ZLIB complexity 0.9988905877088305
Source: plTAoSCew2.exe	Static PE information: Section: ZLIB complexity 0.9935385338345865
Source: plTAoSCew2.exe	Static PE information: Section: ZLIB complexity 0.99267578125
Source: plTAoSCew2.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9988905877088305
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9935385338345865
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99267578125
Source: RageMP131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9988905877088305
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9935385338345865
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99267578125
Source: MPGPH131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@14/60@2/3

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_004DFF00

Source: C:\Users\user\Desktop\plTAoSCew2.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6288
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4908:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess432
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4176:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1068

Source: C:\Users\user\Desktop\plTAoSCew2.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\plTAoSCew2.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: plTAoSCew2.exe, 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmp, plTAoSCew2.exe, 00000000.00000003.1666366479.00000000028B0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938053535.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1698887764.00000000028D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1699835133.00000000028E0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1950317365.000000000055D000.00000002.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000A.00000002.1885484407.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000000A.00000003.1809231647.0000000000F30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1978107084.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000011.00000003.1889498144.0000000000F10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: plTAoSCew2.exe, 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmp, plTAoSCew2.exe, 00000000.00000003.1666366479.00000000028B0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938053535.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1698887764.00000000028D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1699835133.00000000028E0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1950317365.000000000055D000.00000002.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000A.00000002.1885484407.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000000A.00000003.1809231647.0000000000F30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1978107084.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000011.00000003.1889498144.0000000000F10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: MPGPH131.exe, 00000006.00000003.1772122217.0000000005824000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771164349.0000000005824000.00000004.00000020.00020000.00000000.sdmp, lYr9Rb7gll4tLogin Data For Account.0.dr, CVJRxkpfLg0jLogin Data.5.dr, EioxHbeh0kFpLogin Data.0.dr, t2IZA4tw1EDpLogin Data For Account.5.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: plTAoSCew2.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\plTAoSCew2.exe

File read: C:\Users\user\Desktop\plTAoSCew2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\plTAoSCew2.exe "C:\Users\user\Desktop\plTAoSCew2.exe"
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1920
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1876
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6288 -s 1744
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: plTAoSCew2.exe

Static file information: File size 3529232 > 1048576

Source: plTAoSCew2.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x2a6200

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_004CF280

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: plTAoSCew2.exe	Static PE information: section name:
Source: plTAoSCew2.exe	Static PE information: section name:
Source: plTAoSCew2.exe	Static PE information: section name:
Source: plTAoSCew2.exe	Static PE information: section name:
Source: plTAoSCew2.exe	Static PE information: section name: .themida
Source: plTAoSCew2.exe	Static PE information: section name: .boot
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .themida
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .themida
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_006C88F4 push eax; mov dword ptr [esp], ecx	0_2_007E9F46
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_006C88F4 push 2238CB59h; mov dword ptr [esp], ebx	0_2_007E9F78
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_006C88F4 push edx; mov dword ptr [esp], ebx	0_2_007E9FF0
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00433F59 push ecx; ret	0_2_00433F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006C88F4 push eax; mov dword ptr [esp], ecx	5_2_007E9F46
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006C88F4 push 2238CB59h; mov dword ptr [esp], ebx	5_2_007E9F78
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_006C88F4 push edx; mov dword ptr [esp], ebx	5_2_007E9FF0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00433F59 push ecx; ret	5_2_00433F6C

Source: plTAoSCew2.exe	Static PE information: section name: entropy: 7.9802115805595335
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.9802115805595335
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.9802115805595335

Source: C:\Users\user\Desktop\plTAoSCew2.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\plTAoSCew2.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\plTAoSCew2.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-53634
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\plTAoSCew2.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\plTAoSCew2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-53655
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-53748
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	0_2_00493F40
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004938D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	5_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	5_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_004938D0

Source: C:\Users\user\Desktop\plTAoSCew2.exe

0_2_004DFF00

Source: MPGPH131.exe, 00000006.00000003.1787428377.0000000005818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J
Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWfsZ
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001020000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RageMP131.exe, 0000000A.00000002.1886588221.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: MPGPH131.exe, 00000005.00000002.1939291540.000000000568C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_55C92DC3.oj
Source: RageMP131.exe, 00000011.00000003.1901450002.0000000001039000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J6HEdjEHUub5EtqTQ2dk3wwrCNfruTWZeEqONRrqgXAW0ke6pZXg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*?h
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHq
Source: plTAoSCew2.exe, 00000000.00000002.1965989888.00000000057C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}+
Source: MPGPH131.exe, 00000006.00000002.1951132632.0000000000C90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000001065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW11
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}!?
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: RageMP131.exe, 00000011.00000002.1979076933.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: RageMP131.exe, 0000000A.00000002.1886588221.000000000100B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: RageMP131.exe, 00000011.00000003.1901450002.0000000001039000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000005.00000003.1711785629.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5>
Source: MPGPH131.exe, 00000005.00000003.1786679262.00000000056DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\Public
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW4
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _vmware
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \?\scsi_vmwaretual_dif219&0&3f563070-94f2-b8b}~
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&2g
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: plTAoSCew2.exe, 00000000.00000002.1965989888.00000000057C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}!
Source: plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_55C92DC3-J
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MPGPH131.exe, 00000006.00000003.1787428377.0000000005818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_55C92DC3
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: RageMP131.exe, 0000000A.00000003.1821753153.0000000001013000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00438A64

Source: C:\Users\user\Desktop\plTAoSCew2.exe

0_2_004CF280

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004C6D80 mov eax, dword ptr fs:[00000030h]	0_2_004C6D80
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00493F40 mov eax, dword ptr fs:[00000030h]	0_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004C6D80 mov eax, dword ptr fs:[00000030h]	5_2_004C6D80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00493F40 mov eax, dword ptr fs:[00000030h]	5_2_00493F40

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Code function: 0_2_004E9A70 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

0_2_004E9A70

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043451D
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00438A64
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0043451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00438A64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_004CF280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 5_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		5_2_004CF280

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_004DFF00
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: GetLocaleInfoW,	0_2_004531CA
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: EnumSystemLocalesW,	0_2_0044B1B1
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004532F3
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: GetLocaleInfoW,	0_2_004533F9
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004534CF
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: GetLocaleInfoW,	0_2_0044B734
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00452B5A
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: GetLocaleInfoW,	0_2_00452D5F
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: EnumSystemLocalesW,	0_2_00452E51
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: EnumSystemLocalesW,	0_2_00452E06
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: EnumSystemLocalesW,	0_2_00452EEC
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452F77
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_004531CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_0044B1B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_004532F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_004533F9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_004534CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_0044B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00452B5A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	5_2_00452D5F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452E51
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452E06
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	5_2_00452EEC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00452F77

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\plTAoSCew2.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\plTAoSCew2.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\plTAoSCew2.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\plTAoSCew2.exe

0_2_004DFF00

Source: C:\Users\user\Desktop\plTAoSCew2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1817420453.00000000056E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1786962093.00000000056E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1786825043.00000000056E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1951132632.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1939291540.00000000056E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1939291540.000000000568C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1786572125.00000000056E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: plTAoSCew2.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RRyR9q5fccm7OnjvPC2dXYR.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\i6XbcxN8dLmuU_sWPwGcEWP.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: plTAoSCew2.exe, 00000000.00000002.1965989888.00000000057C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\walletsi
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx_&
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: plTAoSCew2.exe, 00000000.00000002.1965989888.00000000057C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000001001000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json*
Source: plTAoSCew2.exe, 00000000.00000002.1965989888.00000000057C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsPN}Q
Source: plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: plTAoSCew2.exe, 00000000.00000003.1753421786.000000000580D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\plTAoSCew2.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\plTAoSCew2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: plTAoSCew2.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6288, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1817420453.00000000056E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1786962093.00000000056E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1786825043.00000000056E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1951132632.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1939291540.00000000056E4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1939291540.000000000568C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1786572125.00000000056E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: plTAoSCew2.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 1068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RRyR9q5fccm7OnjvPC2dXYR.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\i6XbcxN8dLmuU_sWPwGcEWP.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	351 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	12 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
plTAoSCew2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	51%	ReversingLabs	Win32.Trojan.RiseProStealer
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	51%	ReversingLabs	Win32.Trojan.RiseProStealer

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://t.me/risepro_botJ	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exe	100%	Avira URL Cloud	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33J	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exe	100%	Avira URL Cloud	malware
https://ipinfo.io/widget/demo/8.46.123.33P	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exe.1	100%	Avira URL Cloud	phishing
https://t.me/risepro_botQB	0%	Avira URL Cloud	safe
https://db-ip.com/	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	Avira URL Cloud	safe
https://t.me/risepro_botX	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTZ	0%	Avira URL Cloud	safe
https://ipinfo.io/Wp	0%	Avira URL Cloud	safe
https://t.me/risepro	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33e	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33U	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exeP	100%	Avira URL Cloud	phishing
https://ipinfo.io/p	0%	Avira URL Cloud	safe
https://db-ip.com/6	0%	Avira URL Cloud	safe
https://ipinfo.io/t	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33V0	0%	Avira URL Cloud	safe
https://t.me/risepro_botisepro_bot	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33o	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT4	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://t.me/risepro_bot.46.123.33	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33XB	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exeisepro_bot	100%	Avira URL Cloud	phishing
https://db-ip.com/i	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
http://microsoft.co	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://t.H	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	Avira URL Cloud	safe
https://ipinfo.io/Mozilla/5.0	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33tA	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exe963	100%	Avira URL Cloud	phishing
https://t.me/risepro_bot	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exe00.1	100%	Avira URL Cloud	phishing
https://db-ip.com/z	0%	Avira URL Cloud	safe
https://t.5F	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://db-ip.com/u	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
https://support.mozilla.org	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
https://ipinfo.io/Grr	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT-n	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exe	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		unknown
db-ip.com	104.26.5.15	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/8.46.123.33	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.91.77.81/mine/amadka.exe	MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33J	MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951132632.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001026000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000104D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	D87fZN3R3jFeplaces.sqlite.0.dr	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botJ	RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exe	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1939291540.00000000056BD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1952431025.00000000057FD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://77.91.77.81/mine/amadka.exe.1	MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://ipinfo.io/widget/demo/8.46.123.33P	MPGPH131.exe, 00000006.00000002.1951132632.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/	MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.000000000106F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botQB	MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	plTAoSCew2.exe, 00000000.00000003.1746011314.0000000005817000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1748770290.0000000005838000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775059834.0000000005700000.00000004.00000020.00020000.00000000.sdmp, tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33U	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botX	RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro	RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTZ	plTAoSCew2.exe, 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/Wp	MPGPH131.exe, 00000005.00000002.1938691666.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33e	RageMP131.exe, 00000011.00000002.1979076933.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/p	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exeP	MPGPH131.exe, 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	false	URL Reputation: safe	unknown
https://db-ip.com/6	RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/t	MPGPH131.exe, 00000006.00000002.1951132632.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33o	MPGPH131.exe, 00000005.00000002.1938691666.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botisepro_bot	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33V0	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot.46.123.33	MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT4	MPGPH131.exe, 00000005.00000002.1939291540.000000000568C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33XB	MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exeisepro_bot	MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://microsoft.co	MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	plTAoSCew2.exe, 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmp, plTAoSCew2.exe, 00000000.00000003.1666366479.00000000028B0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938053535.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1698887764.00000000028D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1699835133.00000000028E0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1950317365.000000000055D000.00000002.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000A.00000002.1885484407.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000000A.00000003.1809231647.0000000000F30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1978107084.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000011.00000003.1889498144.0000000000F10000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.9.dr	false	URL Reputation: safe	unknown
https://t.me/RiseProSUPPORT	MPGPH131.exe, 00000006.00000002.1951132632.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, RRyR9q5fccm7OnjvPC2dXYR.zip.5.dr, i6XbcxN8dLmuU_sWPwGcEWP.zip.0.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	plTAoSCew2.exe, 00000000.00000003.1746011314.0000000005817000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1748770290.0000000005838000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775059834.0000000005700000.00000004.00000020.00020000.00000000.sdmp, tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr	false	Avira URL Cloud: safe	unknown
https://t.H	RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	false	URL Reputation: safe	unknown
https://db-ip.com/i	MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/Mozilla/5.0	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951132632.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000000A.00000002.1886588221.0000000001026000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1979076933.000000000104D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exe963	plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	false	URL Reputation: safe	unknown
https://t.me/risepro_bot	RageMP131.exe, 00000011.00000002.1979076933.0000000001071000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.5.dr, passwords.txt.0.dr	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33tA	RageMP131.exe, 0000000A.00000002.1886588221.0000000001030000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/z	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exe00.1	MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.maxmind.com/en/locate-my-ip-address	plTAoSCew2.exe, MPGPH131.exe	false	Avira URL Cloud: safe	unknown
https://db-ip.com/u	MPGPH131.exe, 00000006.00000003.1728227491.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.5F	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	plTAoSCew2.exe, 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmp, plTAoSCew2.exe, 00000000.00000003.1666366479.00000000028B0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938053535.000000000055D000.00000002.00000001.01000000.00000004.sdmp, MPGPH131.exe, 00000005.00000003.1698887764.00000000028D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1699835133.00000000028E0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1950317365.000000000055D000.00000002.00000001.01000000.00000004.sdmp, RageMP131.exe, 0000000A.00000002.1885484407.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 0000000A.00000003.1809231647.0000000000F30000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1978107084.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000011.00000003.1889498144.0000000000F10000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.0.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	tJraVEZ3gCYZHistory.5.dr, JaptwNSGRKkjHistory.0.dr, BXcENIBcAk_THistory.5.dr, x2c20gF0jhVeHistory.0.dr	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	plTAoSCew2.exe, 00000000.00000003.1749241617.0000000005849000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1745192277.0000000005818000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1747252402.0000000005839000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1769756212.00000000056EE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1775878542.0000000005721000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000003.1771654121.000000000570F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1773746105.0000000005860000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1772257779.0000000005850000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1776251076.0000000005860000.00000004.00000020.00020000.00000000.sdmp, iNhzurVyetV1Web Data.5.dr, BCrFKBgDjUtEWeb Data.5.dr, A7WIY3rXdqseWeb Data.5.dr, CtJlzgnN12ymWeb Data.0.dr, lbl9TK4Z2XphWeb Data.0.dr, QrwWp85edTOGWeb Data.0.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/Grr	RageMP131.exe, 00000011.00000002.1979076933.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exe	plTAoSCew2.exe, 00000000.00000002.1966229091.0000000005825000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1760783961.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1759698387.000000000580D000.00000004.00000020.00020000.00000000.sdmp, plTAoSCew2.exe, 00000000.00000003.1791446297.000000000581F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000005.00000002.1938691666.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1786597545.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.1951555510.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771670751.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1788060683.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1771282701.0000000000D32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://t.me/RiseProSUPPORT-n	plTAoSCew2.exe, 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.26.5.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
77.91.77.66	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460407
Start date and time:	2024-06-20 23:36:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	plTAoSCew2.exe renamed because original name is a hash value
Original Sample Name:	ad7b4598918c9f75bcad2d3837abc47e.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@14/60@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 68% Number of executed functions: 52 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: plTAoSCew2.exe

Simulations

Behavior and APIs

Time	Type	Description
17:37:22	API Interceptor	3x Sleep call for process: WerFault.exe modified
22:36:58	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:36:58	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:37:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
22:37:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
104.26.5.15	SecuriteInfo.com.Win64.Evo-gen.17494.7440.exe	Get hash	malicious	Unknown	Browse	api.db-ip.com/v2/free/127.0.0.1
	Nemty.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/84.17.52.2/countryName
	227.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/102.129.143.40/countryName
77.91.77.66	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse
	AlCsIOd0pd.exe	Get hash	malicious	RisePro Stealer	Browse
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	PsHQsuTG0H.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
db-ip.com	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.26.5.15
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	104.26.4.15
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	AlCsIOd0pd.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	77.91.77.81
	setup.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	77.91.77.81
	FN MultiHack v2.exe	Get hash	malicious	RedLine	Browse	77.91.77.6
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	PsHQsuTG0H.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments	Get hash	malicious	Unknown	Browse	34.117.239.71
	https://my.visme.co/v/pvmd79je-dj6mqv	Get hash	malicious	Unknown	Browse	34.117.77.79
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
CLOUDFLARENETUS	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	https://qlwcz.semoxqj.ru/jEmXeUJt/#X	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://qlwcz.semoxqj.ru/jEmXeUJt/#X	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184
	https://sigmaalphalambda.org/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.tools.min.js?ver=5.4.8.3	Get hash	malicious	Unknown	Browse	104.26.7.221
	https://i1h.nechole.ru/9Ciz/	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://criticalsystemsllc-my.sharepoint.com/:o:/p/rlingle/EsvC9Qj-ls9HhKnRaEZ1Lz8BvxH0MI-VHwfPjNPle-U1uw?e=5%3aU5b5yJ&at=9&xsdata=MDV8MDJ8YnBha0BkZXdiZXJyeS5jb218YWEyYWY5MTc3YmRhNDI3YWMwMjUwOGRjOTE1ZjI1OWZ8ODRiN2Y1MzdmYjc2NDJiMmFjMWI0MTVhNTU5Nzc2NmN8MHwwfDYzODU0NTA4NTA0NDA0NDI4OHxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=YmpNTzhSaVBMSktXRzI4YjdkN3g4Um1yTTg1RUtvcGw4enpqT1BjVFpqdz0%3d	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://qlwcz.semoxqj.ru/jEmXeUJt/#X	Get hash	malicious	Unknown	Browse	104.17.2.184
	Direct - Deposit 6192024.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://ms-doc.view-saf-eastsuusex-d0c-file239291.com/?Rg=GHhLs	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	ReceiptCopy37.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	Form_Ver-18-13-38.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.26.5.15 34.117.186.192
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	Invoice.docm	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	104.26.5.15 34.117.186.192
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.26.5.15 34.117.186.192
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	setup.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	setup.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3529232
Entropy (8bit):	7.957508090629618
Encrypted:	false
SSDEEP:	49152:ustZbif3Y+7iIP/+luqThrrmOWEgersFUx3VDzjtwrbAzToGb+938BLgd4nOKUKj:3tkfH7Okq5yOjFF1iAz8M/OKmiGXq
MD5:	AD7B4598918C9F75BCAD2D3837ABC47E
SHA1:	C216E887A2559BC45F4B75D8F97E8D2450F16213
SHA-256:	D0E3C511F4C02B9DD4130462AC716024AD29581A072A9095F40AC7C348C7EDE6
SHA-512:	6DE0D861F74E9710A3953AE2196A42DDE9BEE708DDAF40EE294ABEEADAB097B2E3FC9DE1A21AA146F747C821AF16D92C4CAB94537833BF1BBD7396B315D9BE66
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 51%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X [...........@..................................Q6......................................a..........8....................................................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..A..........x..............`....boot....b.. [..b*..x..............`..`.reloc................5................@................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_35771a6693d2f9ed017f28b56de9aedffce803d_f4fd270f_51467a9a-3e89-495a-973b-ac70eee27268\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.042738887564074
Encrypted:	false
SSDEEP:	192:MnQlLna0zU8ST0Z4LO6E6jj/ZrUUJcUzuiFYZ24IO8q6t:MI+AU/AZ4LhjqUzuiFYY4IO81
MD5:	5191D974DDF0EB460B1D7EF9E4FD4D03
SHA1:	FFEDE15B1894E58E9AC120F24CC20EEA96AA7CBA
SHA-256:	84DEDDEE88653DDDC42086E7910EC493234188BD4C0FE75C28B911F63CFC814B
SHA-512:	EAA7DC1B923876DDEDE487C8773813B06D1A79EAF36A54BEF7B50ACB248D531092BDCE2F1FF15EB4DEB1090FAFBB7757E8CB7B02A12E76D174163CCABC83584E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.9.3.0.3.1.7.0.0.8.1.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.9.3.0.3.2.4.3.5.1.9.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.1.4.6.7.a.9.a.-.3.e.8.9.-.4.9.5.a.-.9.7.3.b.-.a.c.7.0.e.e.e.2.7.2.6.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.7.d.e.8.2.6.c.-.6.4.3.a.-.4.a.4.4.-.a.2.b.b.-.7.e.2.0.c.1.3.3.3.2.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.9.0.-.0.0.0.1.-.0.0.1.4.-.2.d.f.6.-.8.c.f.a.5.9.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.c.2.1.6.e.8.8.7.a.2.5.5.9.b.c.4.5.f.4.b.7.5.d.8.f.9.7.e.8.d.2.4.5.0.f.1.6.2.1.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_35771a6693d2f9ed017f28b56de9aedffce803d_f4fd270f_e476fb89-b538-4349-955e-cbfc95808757\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0494018492399162
Encrypted:	false
SSDEEP:	192:6d4Nlhna0zp8ST0Z4LO6E6jjyZrofxjPzuiFYZ24IO8q6t:GIYAp/AZ4LhjLPzuiFYY4IO81
MD5:	963DDA56B3EFBB9AF3B1E42B7624F5B2
SHA1:	08D5C3DB0129F2614AB2D0BEAE5026B36F66335A
SHA-256:	36C913CA36710B351FA0E582F31B1A09F38605AF7783FAD50B314797F1EAFAD0
SHA-512:	4655AA92A2C7AE1A976C0CEE0307BC223F8C30B60E23876A275FFC32158373536D185D373912F91ECEC51825FEC3CD12CD1A6F6BD955640C25292CC3BD2BCDE6
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.9.3.0.3.1.2.1.7.0.7.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.9.3.0.3.2.4.3.5.8.2.3.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.4.7.6.f.b.8.9.-.b.5.3.8.-.4.3.4.9.-.9.5.5.e.-.c.b.f.c.9.5.8.0.8.7.5.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.2.1.4.c.2.7.-.a.d.6.4.-.4.a.b.6.-.9.d.c.b.-.1.c.8.c.e.4.c.d.5.a.c.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.2.c.-.0.0.0.1.-.0.0.1.4.-.9.8.7.b.-.7.a.f.a.5.9.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.c.2.1.6.e.8.8.7.a.2.5.5.9.b.c.4.5.f.4.b.7.5.d.8.f.9.7.e.8.d.2.4.5.0.f.1.6.2.1.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_plTAoSCew2.exe_b578f245089fdb92c49ca29b61d78b5de94bd_4cd93bc8_d4836472-6356-48f9-9aaa-e95ab3a9b742\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0493586555327477
Encrypted:	false
SSDEEP:	192:N5oHTC8557B0O0UdJHJG/oaBjyZrosLZuzuiFYZ24IO8+3:qvn7O1UdJHATjyuzuiFYY4IO82
MD5:	3701D41B0F5A5AD2352E2AD0CE9E1358
SHA1:	81FC5A3C14C8B4C27EF4D8CA65FB719BD9890502
SHA-256:	A31FDED36DF3C2C504BB317E41D8C7AE97F73ACC9FB41325336A540F5211D2A4
SHA-512:	BE64E4BE4B69364D331E8C467E46D0E068C149A5E191F0EFA55CBA66C4DCF138129CF79E0E9E0344593BBA94BCA909D7280B66DFC4A231AEDB59143F36CA8B30
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.9.3.0.2.8.6.9.3.1.0.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.9.3.0.2.9.7.5.5.6.0.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.8.3.6.4.7.2.-.6.3.5.6.-.4.8.f.9.-.9.a.a.a.-.e.9.5.a.b.3.a.9.b.7.4.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.2.5.4.b.d.7.d.-.5.2.4.b.-.4.4.1.4.-.9.f.c.f.-.0.f.6.7.7.e.0.3.3.d.c.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.p.l.T.A.o.S.C.e.w.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.b.0.-.0.0.0.1.-.0.0.1.4.-.8.0.9.6.-.9.9.f.8.5.9.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.c.2.1.6.e.8.8.7.a.2.5.5.9.b.c.4.5.f.4.b.7.5.d.8.f.9.7.e.8.d.2.4.5.0.f.1.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D82.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 21:37:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	104432
Entropy (8bit):	2.0484728446565774
Encrypted:	false
SSDEEP:	384:qPlarGEELI5pzzJFtvJpCLNo3GtAWVw0dOO8vFhvEfXa1a6aJfdYcN7FUyVFgDI4:MarJE8bxFtvJpVMAYw0dOIXyaxCcGj5
MD5:	C63021217C57C54B18E31CB6DDB7EAD2
SHA1:	2815C4BB5D050841FD81CD584A7E7E3694599EDC
SHA-256:	8F776F97089149BF7AE1BC64603918B12B4B4ABA954F3B9AC6A33FD68EF8AAFB
SHA-512:	C07A97B6CB7B795E24549B6BC63490CA43916A2ED4FD581F1159D6BEB6B0108A3942973AA4E029B8CE28E52744292DF770B84F186179765A33B9F6F9ADCEC2EE
Malicious:	false
Preview:	MDMP..a..... .........tf....................................l....#...........L..........`.......8...........T............J..0M...........#...........%..............................................................................eJ.......&......GenuineIntel............T.............tf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3013.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8392
Entropy (8bit):	3.7053449914376984
Encrypted:	false
SSDEEP:	192:R6l7wVeJJ0I6kgX8Xe6Y9WSUXH64gmffTJJoCJG/wprH89bE4sfQHsm:R6lXJ96JMO6YsSUXtgmfrJJ9AtErfU
MD5:	CE00240F000A39EFB5A2A95DCD4CE6E7
SHA1:	4A9433FD27636D83B9173898B7A1A40C9C85B581
SHA-256:	17E018820BAC475D29E5C4B6EF58464265EA3FE1407796688CFF32D9F5AA7793
SHA-512:	33CF47A27608F7DECC218648132F8B35781B6762926AF99C6054255F30EF5F04915D3FD930DBDDA67F8F2F217C40002C448F8D3B64BDC1818930FD1493AF4081
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.2.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3052.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4713
Entropy (8bit):	4.523562624799049
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9+JWpW8VYnYm8M4JQOhF+r+q8TOJ8RY0d:uIjfdI7447VjJQVrZJ8RY0d
MD5:	73BD4E3CB3DE9FB06032A65C727A7E7C
SHA1:	988414E04653430A89A145CCBC209686E0F623A2
SHA-256:	89F544120C6849C0CFA58BC0D64E417354CADB7B442097CA9ED32A9DA2F90459
SHA-512:	36505C2B9FA8EC73716317521DE9703A4082AA6CC49AF008DA1A537AB380A6C5320075CB0F0D90B494F4C56CB529C233766A7E9DE2997F132A576C450C13E344
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376599" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3774.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 21:37:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	98408
Entropy (8bit):	2.079714111680401
Encrypted:	false
SSDEEP:	384:Vc8zLPjmpp/RZFtvmYnAMxG77BMQKxZdUoWM5zswplb:C0DEpZFtvqMUR4Yg5Zp
MD5:	6BFC81AE13E87150878BF026F386505C
SHA1:	142DE0E4C56481BFCCFF3EBDF7EBBF39BFE77BC2
SHA-256:	F949C70D7D9762005BC9778E460BD1F5B4036104BD75056F8E8C5C876A4BE323
SHA-512:	C0B40A9E84936A43EFD5F87BA91C685B7DC49364021DDD60690EBCC251D932C3B78FB9AF4143E8F575B634C96318C7B95C4C2D1DDE37350430545E7618DB4DD4
Malicious:	false
Preview:	MDMP..a..... .........tf....................................l...`#...........I..........`.......8...........T............I...6...........#...........%..............................................................................eJ......P&......GenuineIntel............T.......,.....tf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER393A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 21:37:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103516
Entropy (8bit):	2.0396944247287747
Encrypted:	false
SSDEEP:	384:/XLPnHsH6PY8Rtvj/NJRzGRPs/9gwoGAwNqD/y+2GFxnC8PknlggVKtyt:/XDHRPY8Rtvj/bsslkt2yq
MD5:	755AD5DCE781248BFA6BA01844FF8850
SHA1:	BB5792CCF8253C33D842BDB1BD0490F6A3CE55A5
SHA-256:	12D3A7C5A1C7A562B1ADAABE3C6DD61D5CE8BA2739797024DE9F3219FFD86505
SHA-512:	31A978126F0E18A2164C311714A5A5CA1F4B2220B336BA6ECF05E7C14F5EC1F0C076C37310CF1428DED87C8B351EC6FA435E52D374BD7CA85C46F21243AD728B
Malicious:	false
Preview:	MDMP..a..... .........tf........................,...........l...$#..........rL..........`.......8...........T............H...K...........#..........\|%..............................................................................eJ.......&......GenuineIntel............T.............tf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39F6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	3.7310048821161064
Encrypted:	false
SSDEEP:	192:R6l7wVeJMXus6mjRX5XeYiiJJapr089bdfsf5fm:R6lXJMN6mdJOYBJJ+dEfM
MD5:	49F64767136D56F12198D0A6228F1D54
SHA1:	E9DC2D4E12C55895355130E1FEAA73D1F764F835
SHA-256:	88A5DF2F930869D82C5AD8FEB00B68DE70A4D6F1169D5114DB037366E233A827
SHA-512:	5328F1930A19C938C3DB2FA534B849342BDB14473A31502C98B482069A1F0BE4C9D21F35B8F32DE131B2E4C9493B7D776C6CA6E1FE5D54F68E88504B0A4DB4AD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A26.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.521239550743665
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9+JWpW8VYcLYm8M4JHYFWjW+q8zy84nRnnd:uIjfdI7447V2JrWV80Bnd
MD5:	48C0F93EB828F84D03802F3093415893
SHA1:	FC7977F9A35F5DA56E4BB69FB539A64FE75E9910
SHA-256:	B21A058AED77B2B6D64ABF0657219D9700B04E54C470E2167E2F9562E8C1B086
SHA-512:	EFD43F4834E3309D16DD22D3A9B1B5659AA2AB2B119AB915560BFA691D40A7E3213DF11F98F45DD84FD9A8EC0CBF9737403CD8225BF96733DC73A8546657E81B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376599" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A63.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	3.7277080038108115
Encrypted:	false
SSDEEP:	192:R6l7wVeJNuJ60+wmYiiJJaprr89bG3sfTCm:R6lXJS6RwmYBJJjG8fH
MD5:	8FAFDF3FC3C78BF789AA20F9D56D35D6
SHA1:	2BABCBEDC3BA5A979E1B667A02EFE6950126A125
SHA-256:	ED847B00DA79C5752BCE4538BE24BA5D006F2F589E401424DAE6934580FFC772
SHA-512:	0FCFC62E318EB7089E9F88BAA0B5449BDE3054335F353460C2B6B044A87DCFB52075811D7CD43A70DB45663B8140A6E51F33093FB5C9E0126D1E3BFEF6498B5F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AC2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.520833527090707
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9+JWpW8VYWYm8M4JHYFa+q8zNY84nRn2d:uIjfdI7447ViJTB80B2d
MD5:	3C32FEC935E4D790E1AE5623EC6FA144
SHA1:	7CE868890F41FA1D8BD91FC9AD12A4199BF227E6
SHA-256:	E2FD1E00DA6B4C3B6D306DAE99D1B567AD7AE92E9F79A47A3623414F5168FA0E
SHA-512:	F6EB3CA8BEB0E575363B865F1886E95EB45699320A204E08CF50ACFF1F57E112906E6622E96C60051F580F5993439257A39E756A3A023E1D741E4080F11A6F82
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376599" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3529232
Entropy (8bit):	7.957508090629618
Encrypted:	false
SSDEEP:	49152:ustZbif3Y+7iIP/+luqThrrmOWEgersFUx3VDzjtwrbAzToGb+938BLgd4nOKUKj:3tkfH7Okq5yOjFF1iAz8M/OKmiGXq
MD5:	AD7B4598918C9F75BCAD2D3837ABC47E
SHA1:	C216E887A2559BC45F4B75D8F97E8D2450F16213
SHA-256:	D0E3C511F4C02B9DD4130462AC716024AD29581A072A9095F40AC7C348C7EDE6
SHA-512:	6DE0D861F74E9710A3953AE2196A42DDE9BEE708DDAF40EE294ABEEADAB097B2E3FC9DE1A21AA146F747C821AF16D92C4CAB94537833BF1BBD7396B315D9BE66
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 51%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X [...........@..................................Q6......................................a..........8....................................................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..A..........x..............`....boot....b.. [..b*..x..............`..`.reloc................5................@................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\RRyR9q5fccm7OnjvPC2dXYR.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5620
Entropy (8bit):	7.892603574184713
Encrypted:	false
SSDEEP:	96:fUT29vHz9WQBavDziBP1Pe4McobRHSIBA6FuXcKjD09KGc50RAL0h3KJD:fUT29Hz9WGFh1Pe4q4gAaRKEq50SLs6d
MD5:	56E6512FAAF541CE169EB8010369D34F
SHA1:	B55E3AD6C1E6D609976E57292A81C476FBD245D6
SHA-256:	50EBAF9B4D8551E74F2AA1EE5F87F0ED6073CF85829EA2BC5894C435D2DFF5A5
SHA-512:	9C892457F3D13E654465C95B09A7AD7E86885C19A4D55232FB3525D8C5D084F4EC1975DBC3B1F0748F470B21F657D5CDA272FD25BF66B20618091FC6644F7274
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\RRyR9q5fccm7OnjvPC2dXYR.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........X..s@..../......Cookies\Chrome_Default.txt.G.....5..G.BMx.....%.M...{...?.LH..71.t.....:y3..s./.0.m.%......../. ..!..A.C.........;...x...........!.2.....Z..<....<.h8..<.q;.....9....gK.}.R.#f...A.E...1...?lR....b.....nS=l.%E&'...>x......h.......E)C..t..'.2<Z_@.........&Lk......0..B.mqk.9M1lf.-e@....E.v..R&..\|..-....C.w.Y.K... ........k..3..2W5.!vs.....S.~.......0._.*..e.....U...).....>...g+;...z[Ks....Z..d...\|.".v..(...I....+.7.y.X@.H....eV.............Y..c..x...Kw.'S>.d\|.....B..k.p..\|C\|F.......O52....`f.3W..../....i..E...7..c.Kwv..,]..C..j.2.T..+............t.2....6.M>..s..K.M...VJ..>;.......n.<f;]s.K..5...n....~$ ....%......Z#.....Q5...<n...I&......0<:..>..I.K)g.)..KX.H.(Y!..j4W.j..1.V..d\.T..,p...D...T..>z...,.....L.....Mh.t..!....A...!?.U...x..[a7j.N;#..t.\.#.Z.-)f...v_.<..?..`.D0..?......).vX.#...Lw.j...1.....M.#...+.W....h....U.W....G.w......'.Y?.....;.....`...X...C..w..

C:\Users\user\AppData\Local\Temp\i6XbcxN8dLmuU_sWPwGcEWP.zip

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5542
Entropy (8bit):	7.896896363447472
Encrypted:	false
SSDEEP:	96:5WGzqeAoMq+YK0KF8cAJiI2i+uuVhhR/qlUHgJLFzzyWjypn3KJy:NqASpF8wFj3/qOHetApn6Jy
MD5:	CDD4AF5DFEC0C20E407C646977BEE603
SHA1:	999913D4EEA09837B80079D46928768AEC77530E
SHA-256:	E1E9E6D6CB1455A2E28052913DBDC42F21AA9A4CB25F36711200D50AE9432229
SHA-512:	B1C5808D82DC77FB4D8D4AF87B1AA056B166CAB27CEE2801E97727AC490DF8C332745F53ED8562ABD31C655CAC98373296DB02D0FC146089A2F06BE0B8AA1DDA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\i6XbcxN8dLmuU_sWPwGcEWP.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7773627950641697
Encrypted:	false
SSDEEP:	3:L1XQdXC:RIy
MD5:	AE34C61723DDF52758CC3F13D7970C57
SHA1:	4923AB6CD96582BA7B208F4F9FFCF11BA2F4231F
SHA-256:	CBCBDD2A0ABB906D1A83F49912A639195F8C719CA36E262AB0675CC59FD9C543
SHA-512:	0AAF44FEC22E411C5F53428B370422E1E0967F9AF41CF572D755067EACBF30794A163340D4978FC8D0CE2C4D71AF9793DC96F9AA80282C2A56194B61FBD1DB7E
Malicious:	false
Preview:	1718925824311

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\CtJlzgnN12ymWeb Data

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\EioxHbeh0kFpLogin Data

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\JaptwNSGRKkjHistory

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\LziObAp_xQYkWeb Data

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\NyfGPm9JO5aHLogin Data

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\QrwWp85edTOGWeb Data

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\RYPsmo4mFY2aHistory

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\cfLC6XtY7TPDHistory

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\lYr9Rb7gll4tLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\lbl9TK4Z2XphWeb Data

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\mzHFeshqUZ3VWeb Data

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\rezvwwxF677yCookies

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\wjDnbZn87O29Web Data

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span46Z3XSirMLZy\x2c20gF0jhVeHistory

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\1lz2X_hnlF_eWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\A7WIY3rXdqseWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\BCrFKBgDjUtEWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\BXcENIBcAk_THistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\CVJRxkpfLg0jLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\K1yVDI_8n9leCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\O360yHtwBjGMHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\Un_yyl_MyyCnWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\iNhzurVyetV1Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\sxoey4yhYvwRHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\t2IZA4tw1EDpLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\tJraVEZ3gCYZHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\u2IKyytiUcYXWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanDo7faKvaMiW4\xKOuSFGt78HrLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy46Z3XSirMLZy\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixy46Z3XSirMLZy\information.txt

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6389
Entropy (8bit):	5.479716282283
Encrypted:	false
SSDEEP:	96:x4khORU2cT4Aisph+9hcmIUXMjJbeagOrIANUbg3x:xs62vAtphWhcmIUXo9gqB
MD5:	ADBA9E930088DCCADED408D488BCA524
SHA1:	E2F71BDE6EA1471CB105269303E557220D46E411
SHA-256:	FD80C0ACB322111E493EF21E60512EA0AF049321A594BAF0DD1DB84F9A27A6FF
SHA-512:	3458F09EFC0F18E454BC935A24C18D1CAF0BE568679BDD4364E23FC0C73981E8DFB438E37694F4F6B4E3A90BA710E1BC14B72E6836841BA1BD82020E76DF1D76
Malicious:	false
Preview:	Build: gemot..Version: 2.0....Date: Thu Jun 20 17:37:03 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 495bfda387306805044874eb6e629f2d....Path: C:\Users\user\Desktop\plTAoSCew2.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy46Z3XSirMLZy....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 347688 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 17:37:3..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe

C:\Users\user\AppData\Local\Temp\trixy46Z3XSirMLZy\passwords.txt

Download File

Process:	C:\Users\user\Desktop\plTAoSCew2.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyDo7faKvaMiW4\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	12170
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	192:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WhHGYUnOTNC5IcXkWFXZQHRFJ5Pts7c3aP:gwsPbtKvCpqq40wsPbtKvCpqq47
MD5:	B6F52D24FC4333CE4C66DDA3C3735C85
SHA1:	5B69F1D66E95EFE2CF1710E9F58526B2AAEC67E4
SHA-256:	0FEE1A764F541EC6733DB89C823296650F6E581CD7D812D5A142B5A0AD9BC9B6
SHA-512:	CD2C6D64083061D7C7A7E89CF9C9F7D2B66301C73CFB56D2CCD94D1B810DE42774DAE5B77DB2E567A26FC54989C04D8A60D76225E6F3F91FCD2AE4D2E01F3C4C
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyDo7faKvaMiW4\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6388
Entropy (8bit):	5.480392352298229
Encrypted:	false
SSDEEP:	96:x4A9ORUDWcT4Aisph+9hcmIUXMjJbeagOrIANUbg3x:xs6DWvAtphWhcmIUXo9gqB
MD5:	F94C9954A67D9102136BB9830F916052
SHA1:	3E207C4D5F8508868800F435F440B65F9F9542EC
SHA-256:	ED8EB3F2D30734281F66C4AD96EF6D67551EABC95F733F98FBC073B9C619843A
SHA-512:	77B253CBEED406693F195715798FCBFF3AD63D7007004C0F006AC43D1D6BA0FBD9A122DC08F8B62255FFFE0AE4BAB5FD924BA26734C1C6FD65D4D683E93EB002
Malicious:	false
Preview:	Build: gemot..Version: 2.0....Date: Thu Jun 20 17:37:07 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 495bfda387306805044874eb6e629f2d....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyDo7faKvaMiW4....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 347688 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 17:37:7..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe

C:\Users\user\AppData\Local\Temp\trixyDo7faKvaMiW4\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469055216455085
Encrypted:	false
SSDEEP:	6144:AIXfpi67eLPU9skLmb0b4fWSPKaJG8nAgejZMMhA2gX4WABl0uN1dwBCswSbr:FXD94fWlLZMM6YFHP+r
MD5:	D538BD34F509E98545C684629889E34D
SHA1:	432356CB70EE010A83D1F679B81051AC61E001CE
SHA-256:	F3EE534FC16C1C209D036D456CCC463CD63A98EEEF9F0BD33569DD4086040E77
SHA-512:	EF18C6795645DE8127354F9AFD1F7A5A09D161074BF8CE76C74AD5D00E9A421EFB4D55669147DD48F4B87B76983DB6637A63640E9DDBCC935DF657A61C0AD158
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmb._.Z................................................................................................................................................................................................................................................................................................................................................?H4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.957508090629618
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	plTAoSCew2.exe
File size:	3'529'232 bytes
MD5:	ad7b4598918c9f75bcad2d3837abc47e
SHA1:	c216e887a2559bc45f4b75d8f97e8d2450f16213
SHA256:	d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6
SHA512:	6de0d861f74e9710a3953ae2196a42dde9bee708ddaf40ee294abeeadab097b2e3fc9de1a21aa146f747c821af16d92c4cab94537833bf1bbd7396b315d9be66
SSDEEP:	49152:ustZbif3Y+7iIP/+luqThrrmOWEgersFUx3VDzjtwrbAzToGb+938BLgd4nOKUKj:3tkfH7Okq5yOjFF1iAz8M/OKmiGXq
TLSH:	4BF533E9C2910F00D3EF8BB332B7646A4A0EBB30079225B6070F47F5A95655C9FE6E54
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	8596a1a0a1a1b171

Static PE Info

General

Entrypoint:	0x9b2058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x664C6914 [Tue May 21 09:27:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63814aaf116ba6abb6496ce4bcad24c6

Entrypoint Preview

Instruction
call 00007FC1A8B9A7B0h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FC1A8B9A64Ch
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FC1A8B9A6B3h
xor eax, eax
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FC1A8B9A747h
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007FC1A8B9A66Ah
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007FC1A8B9A5FBh
mov eax, 00000001h
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FC1A8B9A64Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007FC1A8B9A68Ah
mov ecx, 00000001h
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007FC1A8B9A667h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FC1A8B9A64Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19618b	0x184	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18a000	0x1638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x859000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x197018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x18369c	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x15bbc8	0x9d200	dbc34f7bedc9221fe19b8650f74432bb	False	0.9988905877088305	data	7.9802115805595335	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x15d000	0x27e32	0x10a00	c36a6233a30cf4b9013141ed48c14c71	False	0.9935385338345865	data	7.946439870622599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x185000	0x4930	0x800	2b584a247624043576bf5bad28be1d64	False	0.99267578125	data	7.795052778789591	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18a000	0x1638	0x1800	fe6f3fdb9e7e97cba92d8ce4e4fcc95b	False	0.7220052083333334	data	6.54017046361188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x18c000	0x9858	0x7200	b72b12754fccacda92dcf03b73cf1547	False	0.9803316885964912	data	7.942464677064224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x196000	0x1000	0x400	1b20e07443fa333ff9692026d1e6c6c2	False	0.3984375	data	3.42439969016873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x197000	0x1000	0x200	54a50a058e0f3b6aa2fe1b22e2033106	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x198000	0x41a000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x5b2000	0x2a6200	0x2a6200	c6da66b441a2721584f2970c06fa81a3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x859000	0x1000	0x10	f5bc99b71bad9e8a775cc32747e3ca58	False	1.5	GLS_BINARY_LSB_FIRST	2.474601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x18a440	0x1060	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.8838263358778626
RT_GROUP_ICON	0x18b4a0	0x14	data	Russian	Russia	1.05
RT_VERSION	0x18a130	0x310	data	Russian	Russia	0.45408163265306123
RT_MANIFEST	0x18b4b8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/20/24-23:37:06.459517	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	77.91.77.66
06/20/24-23:36:58.414569	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49731	58709	192.168.2.4	77.91.77.66
06/20/24-23:37:20.478810	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49754	77.91.77.66	192.168.2.4
06/20/24-23:37:07.984285	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49734	58709	192.168.2.4	77.91.77.66
06/20/24-23:37:12.469216	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49742	77.91.77.66	192.168.2.4
06/20/24-23:37:01.576649	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49734	77.91.77.66	192.168.2.4
06/20/24-23:37:23.984675	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49754	58709	192.168.2.4	77.91.77.66
06/20/24-23:36:59.610617	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49731	77.91.77.66	192.168.2.4
06/20/24-23:37:01.475795	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49733	77.91.77.66	192.168.2.4
06/20/24-23:37:07.937383	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49733	58709	192.168.2.4	77.91.77.66
06/20/24-23:36:59.830397	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49731	77.91.77.66	192.168.2.4
06/20/24-23:37:01.695305	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49733	77.91.77.66	192.168.2.4
06/20/24-23:37:01.804652	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49734	77.91.77.66	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 23:36:58.385592937 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:36:58.390779018 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:36:58.390880108 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:36:58.414568901 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:36:58.419641972 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:36:59.610616922 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:36:59.656024933 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:36:59.740719080 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:36:59.740883112 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:36:59.745825052 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:36:59.830396891 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:36:59.874785900 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:00.017927885 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:00.017982006 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:00.018074989 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:00.019625902 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:00.019640923 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:00.803045034 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:00.803179026 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:00.804889917 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:00.804903030 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:00.805254936 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:00.859117031 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:00.872497082 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:00.877897978 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:00.877998114 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:00.879534006 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:00.899147987 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:00.904170036 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:00.920552969 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:00.959105968 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:00.964206934 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:00.964294910 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:00.975054026 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:00.980062008 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.007133007 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:01.007317066 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:01.007395983 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:01.010277033 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:01.010293961 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:01.010308981 CEST	49732	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:01.010315895 CEST	443	49732	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:01.021680117 CEST	49735	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:01.021707058 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.021781921 CEST	49735	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:01.022077084 CEST	49735	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:01.022088051 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.475795031 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.498948097 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.499430895 CEST	49735	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:01.502213955 CEST	49735	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:01.502230883 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.502615929 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.504348993 CEST	49735	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:01.531004906 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:01.544537067 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.576648951 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.606535912 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.606791973 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:01.611610889 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.624788046 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:01.654922009 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.655061960 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.655118942 CEST	49735	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:01.655657053 CEST	49735	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:01.655673981 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.655698061 CEST	49735	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:01.655704975 CEST	443	49735	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:01.656532049 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:01.661258936 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.695305109 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.707531929 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.707712889 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:01.712692976 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.749862909 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:01.804651976 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.812103987 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:01.812160015 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:01.812298059 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:01.813272953 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:01.813287020 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:01.859133005 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:01.870663881 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:01.870702982 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:01.870807886 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:01.872108936 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:01.872128010 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:01.922966957 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:01.968539953 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:01.985030890 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:01.989852905 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.215657949 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.265399933 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.278990030 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.279069901 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.281202078 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.281212091 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.281591892 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.327949047 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.329386950 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.334356070 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.342835903 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.342967987 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.345237970 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.345244884 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.345642090 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.351145983 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.390417099 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.396503925 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.409171104 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.456505060 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.487277031 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.487500906 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.487551928 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.487807989 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.487832069 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.487845898 CEST	49736	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.487853050 CEST	443	49736	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.489835024 CEST	49738	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:02.489866972 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:02.489939928 CEST	49738	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:02.490382910 CEST	49738	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:02.490396976 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:02.538065910 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.538465023 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.538559914 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.538659096 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.538659096 CEST	49737	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:02.538675070 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.538685083 CEST	443	49737	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:02.545224905 CEST	49739	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:02.545253992 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:02.545326948 CEST	49739	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:02.545591116 CEST	49739	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:02.545604944 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:02.555560112 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.555815935 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.555850983 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.555895090 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.556251049 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.556282043 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.556308985 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.556701899 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.556732893 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.556763887 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.557476044 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.557511091 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.557534933 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.557542086 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.557593107 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.557595968 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.558275938 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.558352947 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.558382988 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.558402061 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.558414936 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.558469057 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.560867071 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.560925007 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.561038971 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.561073065 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.561134100 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.673384905 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.673562050 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.673578978 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.673634052 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.674269915 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.674293995 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.674329042 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.729885101 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.765587091 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:02.771115065 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.988953114 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:02.989052057 CEST	49738	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:02.989701986 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:02.991228104 CEST	49738	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:02.991238117 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:02.991575956 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:02.993108034 CEST	49738	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.014269114 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.014362097 CEST	49739	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.020193100 CEST	49739	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.020204067 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.020550966 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.022057056 CEST	49739	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.031023979 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.040505886 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.068510056 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.093569994 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.098429918 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.157871008 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.157965899 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.158057928 CEST	49738	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.158221006 CEST	49738	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.158243895 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.158255100 CEST	49738	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.158269882 CEST	443	49738	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.158663034 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.164633989 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.166456938 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.166702032 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.166764975 CEST	49739	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.166980028 CEST	49739	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.166997910 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.167012930 CEST	49739	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:03.167020082 CEST	443	49739	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:03.167378902 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.172163963 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.316013098 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.359136105 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.420371056 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.440155029 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.468540907 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.484136105 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.484314919 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.489173889 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.502630949 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.507522106 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.708579063 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.735018015 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.749921083 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.780987978 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.812521935 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.817421913 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:03.843899012 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:03.848848104 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.058461905 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.058604002 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.058625937 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.058763027 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.059014082 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.059031010 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.059058905 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.059525013 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.059542894 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.059587955 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.060199022 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.060221910 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.060250998 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.060749054 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.060771942 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.060821056 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.061178923 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.061197042 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.061239004 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.062026024 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.062045097 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.062081099 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.063811064 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.063858032 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.080864906 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.080959082 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.080974102 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.081125975 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.081346989 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.081397057 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.081444979 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.081870079 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.081883907 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.081897974 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.081937075 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.081953049 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.082416058 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.082429886 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.082472086 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.083148003 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.083164930 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.083178997 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.083230972 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.083898067 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.083914995 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.083940983 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.086076975 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.086191893 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.086235046 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.140414000 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.177018881 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.177331924 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.177349091 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.177521944 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.178035975 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.178054094 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.178116083 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.207581997 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.207750082 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.207911968 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.207984924 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.208268881 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.208286047 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.208324909 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.209260941 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.209606886 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.271378040 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.276290894 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.298317909 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.303257942 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.505243063 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.531766891 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.546740055 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.577864885 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.593696117 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.598553896 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.624869108 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.629673958 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.818722963 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.860814095 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:04.874741077 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:04.905986071 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:05.545701027 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:05.545855999 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:05.551949024 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:05.551968098 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:05.551980972 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:05.552006960 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:05.552020073 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:05.552021027 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:05.552093983 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:05.556988955 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:06.459517002 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:06.464560986 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:06.685884953 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:06.734119892 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:07.937382936 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:07.943916082 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:07.984285116 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:07.991029978 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.159583092 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.211005926 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.249737978 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:08.359117985 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:08.362690926 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:08.362834930 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:08.367727041 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.367774010 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.367799044 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:08.367813110 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.367829084 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.368161917 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.378273010 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.462937117 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:08.463036060 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:08.467967987 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.467983961 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.467997074 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.468029976 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.468039989 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:08.468231916 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.468259096 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.473125935 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.827922106 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:08.836241961 CEST	58709	49731	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:08.836322069 CEST	49731	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:11.437526941 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:11.443562031 CEST	58709	49733	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:11.443633080 CEST	49733	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:11.546804905 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:11.554244041 CEST	58709	49734	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:11.554328918 CEST	49734	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:11.873778105 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:11.878916979 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:11.879014015 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:11.894536972 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:11.899708986 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:12.469216108 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:12.516504049 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:12.596687078 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:12.623735905 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:12.628747940 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:12.683515072 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:12.734096050 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:13.252763987 CEST	49745	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:13.252814054 CEST	443	49745	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:13.252908945 CEST	49745	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:13.254426003 CEST	49745	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:13.254446030 CEST	443	49745	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:13.727013111 CEST	443	49745	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:13.727096081 CEST	49745	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:13.730221987 CEST	49745	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:13.730233908 CEST	443	49745	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:13.730995893 CEST	443	49745	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:13.788019896 CEST	49745	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:13.828502893 CEST	443	49745	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:13.914485931 CEST	443	49745	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:13.914767027 CEST	443	49745	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:13.914838076 CEST	49745	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:13.915435076 CEST	49745	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:13.915461063 CEST	443	49745	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:13.918236971 CEST	49747	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:13.918322086 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:13.918540001 CEST	49747	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:13.918839931 CEST	49747	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:13.918864012 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:14.383297920 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:14.383383989 CEST	49747	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:14.384977102 CEST	49747	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:14.384993076 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:14.385351896 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:14.391772032 CEST	49747	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:14.432547092 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:14.543596983 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:14.543855906 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:14.544107914 CEST	49747	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:14.545530081 CEST	49747	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:14.545571089 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:14.545599937 CEST	49747	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:14.545619965 CEST	443	49747	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:14.545962095 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:14.550928116 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:14.804399014 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:14.859077930 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:14.874917030 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:14.879796028 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:15.099287033 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:15.143830061 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:18.218543053 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:18.223828077 CEST	58709	49742	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:18.223892927 CEST	49742	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:19.846676111 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:19.851573944 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:19.851775885 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:19.867244005 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:19.872183084 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:20.478810072 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:20.530931950 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:20.616318941 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:20.616581917 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:20.621351957 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:20.706726074 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:20.749800920 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:20.979058981 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:20.979109049 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:20.979275942 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:20.980009079 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:20.980030060 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:21.435722113 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:21.435833931 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:21.436937094 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:21.436969995 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:21.437199116 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:21.478140116 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:21.520530939 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:21.604255915 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:21.604372978 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:21.604429007 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:21.625149965 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:21.625149965 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 23:37:21.625240088 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:21.625272989 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 23:37:21.630808115 CEST	49757	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:21.630871058 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:21.630958080 CEST	49757	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:21.631248951 CEST	49757	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:21.631283998 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:22.095213890 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:22.095312119 CEST	49757	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:22.099332094 CEST	49757	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:22.099381924 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:22.099756002 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:22.101114035 CEST	49757	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:22.148499966 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:22.271986961 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:22.272108078 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:22.272173882 CEST	49757	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:22.273937941 CEST	49757	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:22.273966074 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:22.273988962 CEST	49757	443	192.168.2.4	104.26.5.15
Jun 20, 2024 23:37:22.273997068 CEST	443	49757	104.26.5.15	192.168.2.4
Jun 20, 2024 23:37:22.274313927 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:22.279220104 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:23.984674931 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:23.989554882 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:24.070168018 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:24.124692917 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:24.142621994 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:24.147519112 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:24.214642048 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:24.265320063 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:24.376527071 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:24.421566010 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:27.484143019 CEST	49754	58709	192.168.2.4	77.91.77.66
Jun 20, 2024 23:37:27.489718914 CEST	58709	49754	77.91.77.66	192.168.2.4
Jun 20, 2024 23:37:27.489780903 CEST	49754	58709	192.168.2.4	77.91.77.66

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 23:37:00.005471945 CEST	54084	53	192.168.2.4	1.1.1.1
Jun 20, 2024 23:37:00.012722969 CEST	53	54084	1.1.1.1	192.168.2.4
Jun 20, 2024 23:37:01.013174057 CEST	51812	53	192.168.2.4	1.1.1.1
Jun 20, 2024 23:37:01.021081924 CEST	53	51812	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 20, 2024 23:37:00.005471945 CEST	192.168.2.4	1.1.1.1	0x1c5f	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jun 20, 2024 23:37:01.013174057 CEST	192.168.2.4	1.1.1.1	0xd404	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 20, 2024 23:37:00.012722969 CEST	1.1.1.1	192.168.2.4	0x1c5f	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Jun 20, 2024 23:37:01.021081924 CEST	1.1.1.1	192.168.2.4	0xd404	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 23:37:01.021081924 CEST	1.1.1.1	192.168.2.4	0xd404	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 23:37:01.021081924 CEST	1.1.1.1	192.168.2.4	0xd404	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

https:

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49730	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:36:50 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-20 21:36:50 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:36:50 GMT content-type: application/json; charset=utf-8 Content-Length: 319 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:36:50 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	34.117.186.192	443	432	C:\Users\user\Desktop\plTAoSCew2.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:00 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:37:01 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:37:00 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:37:01 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:37:01 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	104.26.5.15	443	432	C:\Users\user\Desktop\plTAoSCew2.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:01 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:37:01 UTC	657	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:37:01 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9AFD:CDB2_93878F2E:0050_6674A0FD_14D26362:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fNaiHF853ZFH5GjB7%2BZY8zcnMt%2FgAigJ89MwDqQI%2Fc8Sr4ZUVaPG7DCUyYnA2K1JU0QSUasVrFzam%2BbVLf4sMxqnDPfcn2MwwrbApfVOdFS5gBkC3LoQahmYhw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896ee5d0da17436a-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:37:01 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:37:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	34.117.186.192	443	1068	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:02 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:37:02 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:37:02 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:37:02 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:37:02 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	34.117.186.192	443	6288	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:02 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:37:02 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:37:02 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:37:02 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:37:02 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	104.26.5.15	443	1068	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:02 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:37:03 UTC	665	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:37:03 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9BB3:D068_93878F2E:0050_6674A0FF_14BE55CA:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1I%2B3J3rTb1zziFRFXeXVvyPnL5mbMeHQW30uzG2HjpEp7kHEkc2a6FJFtroYYrjKfC%2BON5VDKUmkdResR%2FwBwaSN9aY%2BeA9puxT5%2F%2BudNtlekQUEMSRZBM%2FY%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896ee5da3ea643d9-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:37:03 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:37:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49739	104.26.5.15	443	6288	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:03 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:37:03 UTC	661	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:37:03 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46E721:9A28_93878F2E:0050_6674A0FF_14BE55CB:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i75Ak%2FfGDfnLKdBm%2BJPAKeLCMmWTKw5RBDvrP7GKHpujIy124JQouIDPPJo6We%2B%2Bsysu4DBkp06a%2F0RVfZGsdNaofVLdnAI6pRE%2FxhfH1XwvypjIi9XoAJBePw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896ee5da48b78c23-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:37:03 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:37:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	34.117.186.192	443	7396	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:13 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:37:13 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:37:13 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:37:13 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:37:13 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	104.26.5.15	443	7396	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:14 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:37:14 UTC	663	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:37:14 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC466F09:DFB8_93878F2E:0050_6674A10A_14D2650C:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q6fQtLLToJz%2Brk3%2BA5EH%2Bz4bWElx2eH%2FBl7TmNRiViy9lQQsQDiJuIUBOfPp8b0RJOAuJ1dbSAGvD8wVnxUlsoXS6kox6%2FulBkSsRDplA%2BGMaYjKPuot%2BLeLyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896ee6216ae41855-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:37:14 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:37:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	34.117.186.192	443	7840	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:21 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 21:37:21 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 21:37:21 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 21:37:21 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 21:37:21 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49757	104.26.5.15	443	7840	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 21:37:22 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 21:37:22 UTC	663	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 21:37:22 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46E74B:6644_93878F2E:0050_6674A112_14BE5845:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IhppOZkfJt%2BW4Ezq5%2B7EoShLFfWMBb6quyVI%2FPo%2Fw%2BSausljmWGBNuV2Y0c660PVbwZmCJOM9%2FBF6qu6%2FAJGCxg117E7hkLAp6PfQJTBaBcHGFVSlBHPqkMBKw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896ee651ba447c9c-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 21:37:22 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 21:37:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:36:55
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\plTAoSCew2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\plTAoSCew2.exe"
Imagebase:	0x400000
File size:	3'529'232 bytes
MD5 hash:	AD7B4598918C9F75BCAD2D3837ABC47E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.1965027381.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.1966042254.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1791524447.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1965027381.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:36:57
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x8f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:36:57
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:36:57
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x8f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:36:57
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:36:58
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'529'232 bytes
MD5 hash:	AD7B4598918C9F75BCAD2D3837ABC47E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.1817420453.00000000056E4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.1786962093.00000000056E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.1786825043.00000000056E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.1939291540.00000000056E4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.1939291540.000000000568C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.1786572125.00000000056E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.1938691666.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 51%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:36:58
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'529'232 bytes
MD5 hash:	AD7B4598918C9F75BCAD2D3837ABC47E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000002.1951132632.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:37:08
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1920
Imagebase:	0x880000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:37:09
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'529'232 bytes
MD5 hash:	AD7B4598918C9F75BCAD2D3837ABC47E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 51%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:37:10
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1876
Imagebase:	0x880000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:37:10
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6288 -s 1744
Imagebase:	0x880000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:37:17
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'529'232 bytes
MD5 hash:	AD7B4598918C9F75BCAD2D3837ABC47E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	51.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	44

Executed Functions

Function 004DFF00 Relevance: 98.4, APIs: 50, Strings: 4, Instructions: 3939registrytimefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004E0556
FindNextFileA.KERNEL32(00000000,?), ref: 004E056C
FindClose.KERNEL32(00000000), ref: 004E057C
GetLastError.KERNEL32 ref: 004E0582
GetLastError.KERNEL32 ref: 004E05A0

Part of subcall function 004E71E0: GetCurrentProcess.KERNEL32(004E0900), ref: 004E71EF
Part of subcall function 004E71E0: IsWow64Process.KERNEL32(00000000), ref: 004E71F6

Part of subcall function 0044196B: GetSystemTimeAsFileTime.KERNEL32(004E0A78,00000000,00000000,?,?,?,004E0A78,00000000), ref: 00441980
Part of subcall function 0044196B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044199F

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?,?,?), ref: 004E0D31
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 004E0DFD
RegCloseKey.ADVAPI32(?), ref: 004E0E32
GetCurrentHwProfileA.ADVAPI32(?), ref: 004E0FCA
GetModuleHandleExA.KERNEL32(00000004,004E5FC0,?,?,?,?,?,?,?,?,00000000), ref: 004E14CB
GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,00000000), ref: 004E14E3
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 004E1E96
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 004E1F62
RegCloseKey.ADVAPI32(?), ref: 004E21E1
GetComputerNameA.KERNEL32(?,?), ref: 004E2215
GetUserNameA.ADVAPI32(?,?), ref: 004E23B3
GetDesktopWindow.USER32 ref: 004E2456
GetWindowRect.USER32(00000000,?), ref: 004E2464
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 004E25CF
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 004E2A95
LocalAlloc.KERNEL32(00000040), ref: 004E2AA7
GetKeyboardLayoutList.USER32(?,00000000), ref: 004E2AC2
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 004E2AED
LocalFree.KERNEL32(?), ref: 004E2CB0
GetLocalTime.KERNEL32(?), ref: 004E2CC7
GetSystemTime.KERNEL32(?), ref: 004E2EDD
GetTimeZoneInformation.KERNELBASE(?), ref: 004E2F00
TzSpecificLocalTimeToSystemTime.KERNELBASE(?,?,?), ref: 004E2F25
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 004E333F
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,?), ref: 004E3491
RegCloseKey.ADVAPI32(?), ref: 004E3542
GetSystemInfo.KERNELBASE(?), ref: 004E356A
GlobalMemoryStatusEx.KERNELBASE(?), ref: 004E361D
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004E3731
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 004E3B14
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004E3C53
Process32First.KERNEL32(00000000,?), ref: 004E3C6B
Process32Next.KERNEL32(00000000,?), ref: 004E3C81
Process32Next.KERNEL32(00000000,?), ref: 004E3D53
CloseHandle.KERNEL32(00000000), ref: 004E3D62
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 004E40D6
RegEnumKeyExA.KERNELBASE(?,00000000,?,?), ref: 004E410D
wsprintfA.USER32 ref: 004E41F0
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 004E4213
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 004E4312
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400), ref: 004E4409
RegCloseKey.ADVAPI32(?), ref: 004E44E5
RegCloseKey.ADVAPI32(?), ref: 004E4500

Strings

gemot, xrefs: 004E0924, 004E09AE
2.0, xrefs: 004E09C7, 004E0A58
;Yb., xrefs: 004E402D
3"A, xrefs: 004DFFC6, 004E0690, 004E0174, 004E0179, 004E0183

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: CloseTime$FileOpenQueryValue$LocalNameSystem$EnumFindNextProcess32$CreateCurrentDevicesDisplayErrorFirstHandleInfoKeyboardLastLayoutListLocaleModuleProcessUserWindow$AllocComputerCopyDefaultDesktopDirectoryFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: 2.0$3"A$;Yb.$gemot
API String ID: 3185416054-425793048
Opcode ID: 8a4499befa84087c96734190f2dbd5b16cc983e1812e10724d9651c8621e90b5
Instruction ID: 762722eee12899a3fad9018c2ab51fc1fd94b4ba954c9d0aaa9e31c72487c533
Opcode Fuzzy Hash: 8a4499befa84087c96734190f2dbd5b16cc983e1812e10724d9651c8621e90b5
Instruction Fuzzy Hash: BFB3EFB4D0426D8BDB25CF99C981AEEBBB1FF48300F1041AAD949B7351DB345A81CFA5

Function 0040B8E0 Relevance: 65.9, APIs: 40, Instructions: 5855fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BA08
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BAD2
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040BF80
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040C47A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C575
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040C969
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040CD72
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D17B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040D29A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040D6F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D9DC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040DAD7
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040DE41
CopyFileA.KERNEL32(?,?,00000000), ref: 0040E55A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040ECF6
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040EEEA
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F45B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F525
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 004101ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00410580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0041088D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00410DC4
CopyFileA.KERNEL32(?,?,00000000), ref: 0041173C
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411904
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00411CD7
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411E6E
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00411FBE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00410B14

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00410F12
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040FEF1

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040FC55

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040F933

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040E6FA

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F

Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0042910D
Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00429155

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040DF3C

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED

CopyFileA.KERNEL32(?,00000000,00000000), ref: 0040D5FD

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040BB07

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040BD37
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C0CC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040C196

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Directory$Create$File$Copy$Find$Cpp_errorThrow_std::_$AttributesErrorFirstLast$FolderPath___std_fs_convert_narrow_to_wide@20$CloseDeleteNextRemove
String ID:
API String ID: 1172780710-0
Opcode ID: a5ab48d61c2b3dff66acd5580ca9f5a7979e211ebeafd6bfe51893aa718087df
Instruction ID: 57087eddf2f8576e704702d152c9cc5b4e2b87ff67a8e07952ed474be97f1841
Opcode Fuzzy Hash: a5ab48d61c2b3dff66acd5580ca9f5a7979e211ebeafd6bfe51893aa718087df
Instruction Fuzzy Hash: 56F3E2B4D0425D8BDF25CF99C981AEEBBB1BF18304F1041AAD849B7341DB385A85CF69

Function 004AA200 Relevance: 56.8, APIs: 10, Strings: 11, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 004AA277

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F

Strings

X<b., xrefs: 004B0396
;Yb., xrefs: 004BAF18
;Yb., xrefs: 004B62DD
Jzv", xrefs: 004BCB48
cannot use operator[] with a string argument with , xrefs: 004B14F5, 004B152D, 004B1580, 004B15B5, 004B15EC, 004B34C2, 004B3500, 004B35B5, 004B83F4, 004B848D, 004BDF6D, 004BE0D4, 004BE129, 004BE17E, 004BE1D9, 004BE22E, 004BE283, 004BE2D8, 004BE32D, 004BE382, 004BFF65, 004BFFA3, 004C0058, 004C1DEA, 004C1E28, 004C1EDD, 004C5EE8, 004C5F20, 004C5FB2
;Yb., xrefs: 004B04F0
WUa5, xrefs: 004BAC90
;Yb., xrefs: 004C47B2
cannot use push_back() with , xrefs: 004B10BB, 004B1333, 004B3367, 004B3558, 004B8296, 004B842E, 004BDFC9, 004BE020, 004BE074, 004BFE23, 004BFFFB, 004C1CD9, 004C1E80, 004C5F5A
;Yb., xrefs: 004B26EA
;Yb., xrefs: 004BCCC8

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$Jzv"$WUa5$X<b.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-383699475
Opcode ID: 00cd188d2fa64ad8964c3ab9e7967e547fc4f3fae0fcfb37dc21949e65736659
Instruction ID: d5c29c46e18a526762dbfc7c8aed9f945ae13eab665394adbd88e65e82b678fb
Opcode Fuzzy Hash: 00cd188d2fa64ad8964c3ab9e7967e547fc4f3fae0fcfb37dc21949e65736659
Instruction Fuzzy Hash: 29B433B0D052698BDB25CF68C984BEEBBB1BF49304F1081DAD449A7281DB746F84CF95

Function 004D7600 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0055B192,000000FF), ref: 004D766C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 004D7693
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7959
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7CBB
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004D8DF7
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 004D9992
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA31E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DA3EF
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA712
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAA7D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DAB4E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAE39
CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 004DB0C9
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB27C
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB556
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB93C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 004DBCF1
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DBEA4
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC17E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC564
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9FB3

Part of subcall function 004DFF00: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004E0556
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E05A0

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC99C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DCAF3

Part of subcall function 004DE430: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DE49D

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9C53

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 004D9648

Part of subcall function 004DFF00: FindNextFileA.KERNEL32(00000000,?), ref: 004E056C
Part of subcall function 004DFF00: FindClose.KERNEL32(00000000), ref: 004E057C
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E0582

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004D91DD

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 004D896A

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 004D8B1D
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004D8362

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 004D8623
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D801B

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID:
API String ID: 1140557632-0
Opcode ID: e82f1e92f549f30e97cc6cc2b299e4ee6cad0568081bbef442e5b3f1a2ecc56a
Instruction ID: 6b404ecdfd53acb60f6cf5d734e717c5294ca690171ae70fa85b8f1a38f34a58
Opcode Fuzzy Hash: e82f1e92f549f30e97cc6cc2b299e4ee6cad0568081bbef442e5b3f1a2ecc56a
Instruction Fuzzy Hash: 76F3F2B4D0525A8BCF15CFA9C9916EEBBB0BF18304F20419AD549B7341DB346B84CFA6

Function 00490440 Relevance: 28.0, APIs: 13, Strings: 2, Instructions: 1749registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?), ref: 0049083B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0049086F
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00490895
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490A2C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490CB3
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490DA0
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490EE1
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00490FCB
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 004910B5
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0049119F
RegCloseKey.ADVAPI32(?), ref: 0049229B
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 004922D1
RegCloseKey.ADVAPI32(?), ref: 004922E5

Strings

cannot use operator[] with a string argument with , xrefs: 0049239E, 004923F3
cannot use push_back() with , xrefs: 00492345

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2041898428-3306948993
Opcode ID: 23dad9be7e4742c3290de62e3e37c39c0e0c4f67347f3be3533d008ac6b135ff
Instruction ID: 6d5f253b48c5edfa20594e0b0a8a78ae050bf84d77acb07cc1b8e3b44561805a
Opcode Fuzzy Hash: 23dad9be7e4742c3290de62e3e37c39c0e0c4f67347f3be3533d008ac6b135ff
Instruction Fuzzy Hash: 511322B0C042698BDB25CF68CD84BEEBBB4BF49304F1042EAD549A7241EB756B85CF54

Function 00493F40 Relevance: 26.5, APIs: 12, Strings: 2, Instructions: 1966fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00493FA7

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

FindFirstFileA.KERNEL32(?,?), ref: 0049455F
FindNextFileA.KERNEL32(00000000,?), ref: 0049496C
FindClose.KERNEL32(00000000), ref: 0049497C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00494A53
CreateDirectoryA.KERNEL32(?,00000000), ref: 00494B19
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00494C9D

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 00494E44
CopyFileA.KERNEL32(00000000,?,00000000), ref: 004950F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00495638
CredEnumerateA.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000004), ref: 004959FD
LocalFree.KERNELBASE(00000000,?,?,?,00000004), ref: 004962D7

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,0041ABA8,?,?,?,00431D09,0041ABA8,005799D8,00000000,0041ABA8), ref: 0043525B

Strings

tmX, xrefs: 00493F4D
cannot use operator[] with a string argument with , xrefs: 00496314, 0049636E

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: File$CopyCreateDirectoryFind$Cpp_errorThrow_std::_$AttributesCloseCredEnumerateErrorExceptionFirstFolderFreeLastLocalNextPathRaise
String ID: cannot use operator[] with a string argument with $tmX
API String ID: 3528249430-2011928656
Opcode ID: 1a02a1b8cea7a3604c6deac95239a3494b5f8674a35ba7ef5cc4d9f5089fb20c
Instruction ID: 1c5c2bc117abc336d538eb0f3ab0e4b698252c7f2e821ac10c87ad1798346723
Opcode Fuzzy Hash: 1a02a1b8cea7a3604c6deac95239a3494b5f8674a35ba7ef5cc4d9f5089fb20c
Instruction Fuzzy Hash: 0E3310B4C042698BDB25CFA8C994BEDBBB0BF18304F1041EAD849A7351EB346B85CF55

Function 00481C10 Relevance: 21.5, APIs: 7, Strings: 4, Instructions: 2202COMMON

Download Yara Rule

APIs

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 004827AB
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00482AA7
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00482DA5
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00483105
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00483433
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 00483737
Concurrency::cancel_current_task.LIBCPMT ref: 004844E1

Strings

cannot compare iterators of different containers, xrefs: 0048449D
type must be boolean, but is , xrefs: 00484507
type must be string, but is , xrefs: 0048455B
cannot get value, xrefs: 0048445E, 00484598

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: FolderPath$AttributesConcurrency::cancel_current_taskErrorFileLast
String ID: cannot compare iterators of different containers$cannot get value$type must be boolean, but is $type must be string, but is
API String ID: 1974481932-2698695959
Opcode ID: 37688a3e03e452b8910011e895e6a8eb4bd289d6ed3cd8873769e4b0518a04a2
Instruction ID: 7d592af2553ac1c7978d8671279e796c0dcb22ab630186640302ddbce1f3b4fb
Opcode Fuzzy Hash: 37688a3e03e452b8910011e895e6a8eb4bd289d6ed3cd8873769e4b0518a04a2
Instruction Fuzzy Hash: D74334B0C042698BDB25DF28C994BEEBBB5BF48304F1082DAD449A7281DB756F84CF55

Function 004E6770 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5
SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
DeleteFileA.KERNEL32(?), ref: 004E6AA4
FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
FindClose.KERNEL32(?), ref: 004E6ACA
GetLastError.KERNEL32 ref: 004E6AD0
SetFileAttributesA.KERNELBASE(?,00000080), ref: 004E6AED
RemoveDirectoryA.KERNELBASE(?), ref: 004E6B0B
GetLastError.KERNEL32 ref: 004E6B20
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Strings

\*.*, xrefs: 004E6834

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: fa9544b1f4525edcf2a18f77abf6cc53c36d2fc4c8b78e4902afa25aa6e8371b
Instruction ID: d809dff945c313677263d2cc5f51936a643c350294cf92fd29307912c56e1fe7
Opcode Fuzzy Hash: fa9544b1f4525edcf2a18f77abf6cc53c36d2fc4c8b78e4902afa25aa6e8371b
Instruction Fuzzy Hash: EDD11670C00288CFDB10DFA9C9487EEBBB1FF65305F20425AE454BB292D7786A89DB55

Function 0049F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049F224
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049F322
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049F515
CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1C76

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1F5D
lstrlen.KERNEL32(?), ref: 004A348E

Strings

;Yb., xrefs: 0049FC4C
cannot use operator[] with a string argument with , xrefs: 004A3571, 004A35C6
~]d, xrefs: 0049FAC6
cannot use push_back() with , xrefs: 004A3518

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $~]d
API String ID: 2833034228-1763774129
Opcode ID: d0cf4de64ad193f4b233d2aae08a9caf55de1bab59726ceb330fbb40ab1f1306
Instruction ID: 3f98b5ef17dcfaa8f689e4fcb5a5d7fbbd5e2711f2842c60bb6495c93d0a2e70
Opcode Fuzzy Hash: d0cf4de64ad193f4b233d2aae08a9caf55de1bab59726ceb330fbb40ab1f1306
Instruction Fuzzy Hash: 2793DCB4D052A98ADB65CF29C990BEDBBB1BF59304F0081EAD84DA7241DB742BC4CF45

Function 004963B0 Relevance: 17.5, APIs: 5, Strings: 4, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00496504
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00496602
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 004967F5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498078
lstrlen.KERNEL32(?), ref: 0049854F

Strings

Tz}9, xrefs: 00497260
cannot use operator[] with a string argument with , xrefs: 004985BE, 00498670
;Yb., xrefs: 004974E8
cannot use push_back() with , xrefs: 0049840C, 0049860E

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: ;Yb.$Tz}9$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-4100205650
Opcode ID: 074035d77b8065e1cc33da42ef3056239dd45ed018233a5fea3ded85fa9596c7
Instruction ID: 6b3be8cf9a559e92d133cc3b6572ed682d4dab2050fd03768d9c929fe5be15d2
Opcode Fuzzy Hash: 074035d77b8065e1cc33da42ef3056239dd45ed018233a5fea3ded85fa9596c7
Instruction Fuzzy Hash: 352300B0D052688BDB25CF28C9947EDBBB5BF49304F1082EAE449A7281DB746BC4CF55

Function 004986B0 Relevance: 16.1, APIs: 4, Strings: 4, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00498804
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00498902
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00498AF8
lstrlen.KERNEL32(?), ref: 0049AE11

Strings

AN|5, xrefs: 00499560
cannot use operator[] with a string argument with , xrefs: 0049AE83, 0049AF19
cannot use push_back() with , xrefs: 0049AD31, 0049AEBA
;Yb., xrefs: 0049968E

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$AN|5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-1903585501
Opcode ID: edf929626061cb72280f4c683da62a59200cb04b193349d1a63bce15248aeab5
Instruction ID: e112265f5291f7fbed9e5ebb381307dd27655726dfd0f1f0b2bb5fda635101ca
Opcode Fuzzy Hash: edf929626061cb72280f4c683da62a59200cb04b193349d1a63bce15248aeab5
Instruction Fuzzy Hash: D44322B0D052688BDB25CF28C8947EEBBB5BF49304F1082EAD449A7242DB756BC4CF55

Function 0049AF60 Relevance: 14.1, APIs: 4, Strings: 3, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049B158
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049B265
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049B458
lstrlen.KERNEL32(?), ref: 0049D22D

Strings

cannot use operator[] with a string argument with , xrefs: 0049D29C, 0049D353
cannot use push_back() with , xrefs: 0049D0EA, 0049D2EC
;Yb., xrefs: 0049BFEE

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-747751661
Opcode ID: 93517ee6eb711d4bd509933be439051feb22b0957d1c900c794dee307da9bfb8
Instruction ID: b2dbe3f5757ef5304a2bca7f4d9e3a7c922558eb406562d1b13ccbd165419304
Opcode Fuzzy Hash: 93517ee6eb711d4bd509933be439051feb22b0957d1c900c794dee307da9bfb8
Instruction Fuzzy Hash: BF2321B0D042688BDB25CF28C9947EDBBB1BF59304F1082EAE449A7281DB746BC4CF55

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
FreeAddrInfoW.WS2_32(?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
FreeAddrInfoW.WS2_32(?), ref: 004C86A5

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 0049D3A0 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049D4F4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049D5F2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049D7E5
lstrlen.KERNEL32(?), ref: 0049EF32

Strings

cannot use operator[] with a string argument with , xrefs: 0049EF9D, 0049EFDB, 0049F08D
cannot use push_back() with , xrefs: 0049EE76, 0049F02B

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: b5ec6e46c9fa93774a4e05dd67c8e5c6bb6882a872f3dbbac4ebd9fb545e5b7d
Instruction ID: d38aed82ee4788d52106214de1412b854dd9129e0c255bb6c7140376d04d8967
Opcode Fuzzy Hash: b5ec6e46c9fa93774a4e05dd67c8e5c6bb6882a872f3dbbac4ebd9fb545e5b7d
Instruction Fuzzy Hash: 570334B0D042688BDB25CF28C9947EEBBB4BF59304F1042EED449A7281EB746B84CF55

Function 004C6D80 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 535
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004C7051

Part of subcall function 00432534: __EH_prolog3.LIBCMT ref: 00432570

std::_Throw_Cpp_error.LIBCPMT ref: 004C7062

Part of subcall function 004E74C0: __fread_nolock.LIBCMT ref: 004E7609

DeleteFileA.KERNELBASE(?), ref: 004C70EB

Strings

gemot, xrefs: 004C7171, 004C718A
131, xrefs: 004C7135, 004C714E

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$gemot
API String ID: 3880692912-2495630133
Opcode ID: ed82176a8a559ef53b8c12fb7edaf71171fa2efdd5e6f73f41023a368e686b71
Instruction ID: 7966019704e3fd473910eda9b3190c6326d4c2da0caac65bea49cbac806563d6
Opcode Fuzzy Hash: ed82176a8a559ef53b8c12fb7edaf71171fa2efdd5e6f73f41023a368e686b71
Instruction Fuzzy Hash: 1E32ACB4D04248CFCB04DFA8C985BAEBBB1BF58304F14419EE8056B392D779AA45CF95

Function 004FAD00 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RTRIM, xrefs: 004FAF68
MATCH, xrefs: 004FB108, 004FB119, 004FB139, 004FB13A, 004FB150
BINARY, xrefs: 004FAF25, 004FAF34, 004FAF4E, 004FAF8E, 004FAF99, 004FAFB1, 004FB003, 004FB004
no such vfs: %s, xrefs: 004FAEB7
automatic extension loading failed: %s, xrefs: 004FB22C
NOCASE, xrefs: 004FB02A
sqlite_rename_table, xrefs: 004FB0E4

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: 709491dc051ea1e70093cc478a2a2d0c63acaf5bae6c4c00e9975ec16f4ae69b
Instruction ID: 5912c9be0b5fe0253428befa1510005b8e6d21b15bd6994098c8da1f87b2af15
Opcode Fuzzy Hash: 709491dc051ea1e70093cc478a2a2d0c63acaf5bae6c4c00e9975ec16f4ae69b
Instruction Fuzzy Hash: 510258B0A007089BEB209F15DC4577B7BE4EF51304F14442EEA4A9B391EBB9E944CBC6

Function 004DF030 Relevance: 8.4, APIs: 5, Instructions: 876
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DF09A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF329

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF52A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF84A

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DFC7D

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID:
API String ID: 2127212259-0
Opcode ID: 0a9d66dacc852727762dd02661486b9ec628ab0a78a4986b9bfafa3a96ef7e23
Instruction ID: 8e27dc709fe3b7ff7b62f4d1f71842afe3ac2492894b6e8ccfd466f18f63ab33
Opcode Fuzzy Hash: 0a9d66dacc852727762dd02661486b9ec628ab0a78a4986b9bfafa3a96ef7e23
Instruction Fuzzy Hash: DBA202B4D0425D8BDF25CFA8C995AEEBBB0BF18304F2041AAD949B7351D7341A84CFA5

Function 004DE430 Relevance: 8.2, APIs: 5, Instructions: 731
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DE49D

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DE8C9
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DEA83
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DED11
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DEE67

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID:
API String ID: 1001086254-0
Opcode ID: 421e36309c22111a033c8f9f38f840648b1e0bb665710f0a707a7c163fba85ac
Instruction ID: 4de69712ac24b7a09e9bc2c7d11d42553b755471a164b72fa8c1d2b7ead1c118
Opcode Fuzzy Hash: 421e36309c22111a033c8f9f38f840648b1e0bb665710f0a707a7c163fba85ac
Instruction Fuzzy Hash: 298225B0C042598BCB15CFA9C995BEEBBB0BF18304F10419ED549BB382DB745A85CFA5

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F
FindNextFileA.KERNELBASE(00000000,00000010), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: 90cf4eca11af66bb089fdb4a1b4223e767fc84b405f6936ed3c5d03910aaf901
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: 90cf4eca11af66bb089fdb4a1b4223e767fc84b405f6936ed3c5d03910aaf901
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 004C6B00 Relevance: 4.7, APIs: 3, Instructions: 206encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004C6B57
LocalFree.KERNEL32(?), ref: 004C6B86
LocalFree.KERNEL32(?), ref: 004C6C82

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: ca1e730759337fa49bbce61ea0016bf7f681cd111c34800b91b137380e4f608d
Instruction ID: 6019ec204b0dd747d4126109e6a4f8e7bf51aa55734569d67b400ef60c6c0d13
Opcode Fuzzy Hash: ca1e730759337fa49bbce61ea0016bf7f681cd111c34800b91b137380e4f608d
Instruction Fuzzy Hash: 6171B171C002489BDB00DFA8C945BEEFBB4EF14314F10826EE851B3391EB786A44DBA5

Function 0053F550 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053F705
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053FA07

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 7cc4ef92f3a6051046a18418b77ea2a3a6de1ed4712a7747bb821a5c40650b69
Instruction ID: 1f76d2344d35fe0e13097961589cbfb84b6978ae6f877586e2245b879765d82e
Opcode Fuzzy Hash: 7cc4ef92f3a6051046a18418b77ea2a3a6de1ed4712a7747bb821a5c40650b69
Instruction Fuzzy Hash: E3029C71A04702AFDB18CF29C840B6ABBE4BF88318F14867DE859D7650D774ED94CB92

Function 0044002D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b15aa9a463d604c256c669c29f6134746f95fa67f9ccc3a2b131056c85d33937
Instruction ID: 127d1e6b524efbadbaaaff55744b8fab0cc6e196c82b7e7b6ae44d0b7ee8643f
Opcode Fuzzy Hash: b15aa9a463d604c256c669c29f6134746f95fa67f9ccc3a2b131056c85d33937
Instruction Fuzzy Hash: 3BB1F67090060A9BFB28CE68D855ABFBBB1AF04304F140A1FDA52A7791C77D9D21CB59

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000358,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Part of subcall function 004C8590: WSAStartup.WS2_32 ref: 004C85BA
Part of subcall function 004C8590: getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
Part of subcall function 004C8590: socket.WS2_32(?,?,?), ref: 004C865D
Part of subcall function 004C8590: connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
Part of subcall function 004C8590: closesocket.WS2_32(00000000), ref: 004C867D
Part of subcall function 004C8590: FreeAddrInfoW.WS2_32(?), ref: 004C868A
Part of subcall function 004C8590: WSACleanup.WS2_32 ref: 004C8690

recv.WS2_32(?,00000004,00000008), ref: 004C7E23
__Xtime_get_ticks.LIBCPMT ref: 004C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004C7EB9

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: f9e28bc168eabd23f713c9d075067e09dfc649ed2f0dd86ee053ab152bb4c171
Instruction ID: b3d54dcccad81d83ab75f13ba9899d4b50e1d8608cabcccfb3508871926cac68
Opcode Fuzzy Hash: f9e28bc168eabd23f713c9d075067e09dfc649ed2f0dd86ee053ab152bb4c171
Instruction Fuzzy Hash: 9EB1AC71D043089BEB10DBA8CC49BAEBBB1BB54314F24025EE815BB2D2D7785D88DF95

Function 0045E140 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045E3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045E4C6
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0045E808
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045EB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045EC10

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045ED06

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045EDED
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045F06D

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: e1ed7e54ebd5b020c8e79904b3ae03e0818e29e9e47e40a3245b38651c09fec3
Instruction ID: 0e418cf523baa0a35c0a910b93c4bb77d5942d6061cfe1063ad62b245a56bb8b
Opcode Fuzzy Hash: e1ed7e54ebd5b020c8e79904b3ae03e0818e29e9e47e40a3245b38651c09fec3
Instruction Fuzzy Hash: 4FA226B0D012688BCB25DB65CD95BDDBBB4AF14304F0040EED44A67282EB785F88DF5A

Function 004E4720 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 004E4A70
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 004E4ADC
LsaOpenPolicy.ADVAPI32(00000000,00587684,00000001,?), ref: 004E4B35
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 004E4B48
LsaFreeMemory.ADVAPI32(?), ref: 004E4B76
LsaClose.ADVAPI32(?), ref: 004E4B7F

Strings

%wZ, xrefs: 004E4B65
&"N, xrefs: 004E472D
;Yb., xrefs: 004E49C7

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$&"N$;Yb.
API String ID: 762890658-4094109456
Opcode ID: 71ef275a8d6462c4c5fc6e537bb68741ac7498f384360e828531ccc0aa0ebddd
Instruction ID: db120a3af714b361d6db134a28a940fef9e0d4b71911d12d67c4190411436b99
Opcode Fuzzy Hash: 71ef275a8d6462c4c5fc6e537bb68741ac7498f384360e828531ccc0aa0ebddd
Instruction Fuzzy Hash: 1EE101B4D0425A8FDB14CF98C985BEEBBB4BF08304F2041AAE949B7341D7745A85CFA5

Function 00448910 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ebc92e5ca6f275d4bbb75147d6ad3a24cc47560e82a7b4de6b8652cd53fa6b
Instruction ID: d4d7462daa34083545f9d93f0c5ebf53bf58a01a885379ada905c47cec286c1a
Opcode Fuzzy Hash: f0ebc92e5ca6f275d4bbb75147d6ad3a24cc47560e82a7b4de6b8652cd53fa6b
Instruction Fuzzy Hash: E2B1F4B0A00245AFFB11DF99C881BAE7BB1FF55304F14015EE414AB392CB78AD81CB69

Function 004D6BA0 Relevance: 9.2, APIs: 6, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
6CF77CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50
SetLastError.KERNEL32(00000000), ref: 004D6CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D25
GetLastError.KERNEL32(?,?,00000000), ref: 004D6D33
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D47

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: ErrorLast$CopyFile
String ID:
API String ID: 936320341-0
Opcode ID: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction ID: cca443e56f4e81c83c2dc89493b37bcb85ee1d7da0cfa031959f485395bd6110
Opcode Fuzzy Hash: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction Fuzzy Hash: 6051C172D01219ABCB21CF94DC55BEEBBB8EB04320F10026AE804B3390D7396E05CBA4

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: f134e1088910f21205feb50cafa7421b375cc3c6533d6feb8916e2264968fd77
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: f134e1088910f21205feb50cafa7421b375cc3c6533d6feb8916e2264968fd77
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 00463830 Relevance: 6.9, APIs: 3, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

Part of subcall function 004E6C10: CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004E6C55

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00465CB0
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00465FD5

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00465EC6

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 05a502395d9f526f757c14469c863ff3b4cefea8d5e99dd5fdd399119d475625
Instruction ID: bdb7de5e538d98cc2bc1e856d074b668cb5d4ba5ca64421d2565693f44b24664
Opcode Fuzzy Hash: 05a502395d9f526f757c14469c863ff3b4cefea8d5e99dd5fdd399119d475625
Instruction Fuzzy Hash: 8053CFB0D052688FDB65DF55C994BDDBBB0BB58304F0041EAD44AA7292EB382F84DF49

Function 004E6CA0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 65662f257d92aefc3507c5f8cb9ddc555297535a90f0ce1970463870aaf9e219
Instruction ID: 241e2f942859b358e1133ab4bf22632851a161ac9c5554c12c2f2fb0b7350d8e
Opcode Fuzzy Hash: 65662f257d92aefc3507c5f8cb9ddc555297535a90f0ce1970463870aaf9e219
Instruction Fuzzy Hash: DF11CE71A0028496DB205F6A5C08F6A7F60EB22772F64031BD8359B3D4DB3948058759

Function 004D6790 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 004D6A20

Part of subcall function 004D6BA0: GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
Part of subcall function 004D6BA0: 6CF77CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50

std::_Throw_Cpp_error.LIBCPMT ref: 004D6B84
std::_Throw_Cpp_error.LIBCPMT ref: 004D6B95

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyErrorFileLast
String ID:
API String ID: 1723067277-0
Opcode ID: e483eb5b337a640106d2fd647702f1d046535e5974e3c1cb80ba773399d43a59
Instruction ID: af59b977606615079acd7a310a8afa41bd250120d803ccb4a837ad8b48953fd5
Opcode Fuzzy Hash: e483eb5b337a640106d2fd647702f1d046535e5974e3c1cb80ba773399d43a59
Instruction Fuzzy Hash: 5BD18BB0C00249DBDB04DFA9C9557EEBBB1BF54304F14419ED80577382EB785A45CBA6

Function 00493B60 Relevance: 4.8, APIs: 3, Instructions: 264registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 00493D89
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?), ref: 00493DAC
RegCloseKey.ADVAPI32(?), ref: 00493DB7

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 77d91e2ffbc41f4e718118182c7f4e60994b52f51d4fd49462c42fe523481256
Instruction ID: c2861601c7c989816088ca7cd521e7ac3defefe444e22908af63c5fcea44e6b0
Opcode Fuzzy Hash: 77d91e2ffbc41f4e718118182c7f4e60994b52f51d4fd49462c42fe523481256
Instruction Fuzzy Hash: C8C136B1D042499FDB14CFA8D986BAEBBB0EF09314F204169E905B7391E7345A84CFA5

Function 004E6C10 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004E6C55

Part of subcall function 00432BAA: RtlReleaseSRWLockExclusive.NTDLL(004E6D30), ref: 00432BBE

std::_Throw_Cpp_error.LIBCPMT ref: 004E6C84
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C95

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 1369faf54573f1097b34743c1b99fafbb3d15d6b7359fe2f2678d7eae3eda35f
Instruction ID: b54f6e02dbe68d52aaf8ce57ceccae370b453a77f91dfdb3bbc81736346272f4
Opcode Fuzzy Hash: 1369faf54573f1097b34743c1b99fafbb3d15d6b7359fe2f2678d7eae3eda35f
Instruction Fuzzy Hash: B2F049B1500640FBD7109F999D06B6ABBA8FB05731F14031AFC35A63D0D7B5190087AA

Function 0044B9D0 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,0043D2B1,?), ref: 0044B9D8
GetLastError.KERNEL32(?,0043D2B1,?), ref: 0044B9E2
__dosmaperr.LIBCMT ref: 0044B9E9

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 09b3d7d03d43d7566e94fc4839c3f2f0e9d57db1a11ed26f70a1bc8201ac59e9
Instruction ID: 29a5b21677c8caf908dcad016bfb5ae84cbfd6cad116b975ceede8be2d8f2443
Opcode Fuzzy Hash: 09b3d7d03d43d7566e94fc4839c3f2f0e9d57db1a11ed26f70a1bc8201ac59e9
Instruction Fuzzy Hash: 00D0C9321146086BEA106BB6BC089163B6D9A913797140616F52CC52A0EE25C895A665

Function 004E57F0 Relevance: 3.4, APIs: 2, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004E588F
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004E5B9B

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: 0a0dcd09eef47cc32d5847b2942677d40245ae2126d3bdebcd0edae20a9bad6e
Instruction ID: 009fea26e280c08ebde66711631a2368a09a7ac58c7b38572a32fddf838a6e16
Opcode Fuzzy Hash: 0a0dcd09eef47cc32d5847b2942677d40245ae2126d3bdebcd0edae20a9bad6e
Instruction Fuzzy Hash: 81F157B0D002499BDB14CFA8C9957EEBBB1FF08304F24425EE545BB381DB756A84CBA5

Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00448E9F: GetConsoleOutputCP.KERNEL32(B86A89DA,00000000,00000000,0043D0C7), ref: 00448F02

WriteFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,?,004E6E3C,?,0043CFE7,004E6E3C,?,00579E10,00000010,0043D0C7), ref: 0044990E
GetLastError.KERNEL32(?,0043CFE7,004E6E3C,?,00579E10,00000010,0043D0C7,004E6E3C,?,00000000,?), ref: 00449918

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 31457cb41688bf9267a4d34aaba0591c787e78cc82baf2098e7bb743f7a0da0b
Instruction ID: 4c198159cf300fc4e9085a349e24ad4d45033eb13303bb4f9288eddf9455663d
Opcode Fuzzy Hash: 31457cb41688bf9267a4d34aaba0591c787e78cc82baf2098e7bb743f7a0da0b
Instruction Fuzzy Hash: 9961C5B1C14119BFEF11DFA8C844AAFBBB9AF49304F14014AE800A7316D739DD05EB65

Function 004D65F0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D676A
std::_Throw_Cpp_error.LIBCPMT ref: 004D677B

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: ee00d86a89ee62715d60b896044e90f690cda42d917c0ef1e64fc9d0a964cb8a
Instruction ID: 177bb7d1701b8dda1f5a90c4ee3be826f8175b366ab48e47effb054e9b4aa952
Opcode Fuzzy Hash: ee00d86a89ee62715d60b896044e90f690cda42d917c0ef1e64fc9d0a964cb8a
Instruction Fuzzy Hash: 6441F2B1E002058BC720DF68995136EBBA1BB94314F19072FE815673D1EB79EA04C795

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E5F

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,0043D0C7,00000000,00000002,00000000,00000000,00000000,00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000), ref: 00442558
GetLastError.KERNEL32(00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000,?,0044982E,00000000,00000000,00000000,00000002,0043D0C7,00000000), ref: 00442565

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 0044B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B030
GetLastError.KERNEL32(?,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B03B

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction ID: f233056e1464041c82b2d36bf1c88bdb576215b3e64377b8de55bab97aefa9e3
Opcode Fuzzy Hash: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction Fuzzy Hash: 66E08C32100204ABEB212FA5AC0CB9A3B69EF00756F15802AF608971B0DB38C894D798

Function 004C7EF0 Relevance: 1.9, APIs: 1, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d479b4dc473ff75364f43403d3a36830ea6f3dd8b2948d9b5135abdfa02e0f6
Instruction ID: 65307ecbef6fb9e01e3d4ad067897c34c173f6a72c2a6aa1ef5fcaa49911cde8
Opcode Fuzzy Hash: 2d479b4dc473ff75364f43403d3a36830ea6f3dd8b2948d9b5135abdfa02e0f6
Instruction Fuzzy Hash: 0E02A070D04248DFDB14DF68C945BDDBBB0AB14308F14419ED8057B386EBB95E88DB9A

Function 00415350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0041546E

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bec13ab4d36df1c77f4f48b23f515b006b246256a435ef31511c977ea406d557
Instruction ID: bd448271620100f3a1b1b6e8090fbb17c8ec551eb96fe3ea9a7077eb077db61a
Opcode Fuzzy Hash: bec13ab4d36df1c77f4f48b23f515b006b246256a435ef31511c977ea406d557
Instruction Fuzzy Hash: AF6199B1A00614DFCB10CF59C984B9ABBF5FF88310F24816EE8199B391C778EA41CB95

Function 00438E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0750673b6008633cc79045623eaeb207d83782e0e9d8302f40567207ba640ce
Instruction ID: 9663080612542d3e5f9b84a36c3ecf1ef98ea00319430370267f097460dfd66c
Opcode Fuzzy Hash: e0750673b6008633cc79045623eaeb207d83782e0e9d8302f40567207ba640ce
Instruction Fuzzy Hash: 2651C670A00204AFDF14DF59C881AAABBA2EF8D328F24915EF8089B352D775DD41CB55

Function 00429E20 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00429F7B

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 49d9410ba7a25a1ed46be8af988e90367723f5328f058a33b79d5012bd0e806f
Instruction ID: efe4cd6a287aa12a83b409d23e88dd93d6c4865ddef84cf0d949cd52fc0f7608
Opcode Fuzzy Hash: 49d9410ba7a25a1ed46be8af988e90367723f5328f058a33b79d5012bd0e806f
Instruction Fuzzy Hash: AA410271E001259FCB14DF68C9419AEBBB9EB89310F64422EE815E7381D738DE01CBE4

Function 004E7640 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E77AC

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 025cbb467e96eb611f2940d14225f23d526d4ccfef296c2d3f6c21a772ab55fe
Instruction ID: 028c77ef4637c0ac0bfd58be9ca2c186fed01019b569c5d695070078eed700b9
Opcode Fuzzy Hash: 025cbb467e96eb611f2940d14225f23d526d4ccfef296c2d3f6c21a772ab55fe
Instruction Fuzzy Hash: A8517FB0D043499BDB10DF99D986BAEFBB4FF44714F10012EE8416B381D7796A44CBA5

Function 004E74C0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E7609

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 630099f540daf6efa67ea676e65f3a2a0d7fe5641c6b0820276aea293422c398
Instruction ID: 959dba962c579710b3c8227977385e6342f185642bc3a86ace1f34c607c4467c
Opcode Fuzzy Hash: 630099f540daf6efa67ea676e65f3a2a0d7fe5641c6b0820276aea293422c398
Instruction Fuzzy Hash: 78416CB0D04248EBDB14DF99D985BEEBBB4FF48714F10416EE801AB381D7799901CBA5

Function 00406870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00406908

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: c3b8b3600ed0ad07f9a4110fed077291c3700e835e34d0cb827fcc3074b6ad22
Instruction ID: 382a6ddcba4688358f9e0a4ad0208e6a3358ad319658d54a7c18dfc33c73484c
Opcode Fuzzy Hash: c3b8b3600ed0ad07f9a4110fed077291c3700e835e34d0cb827fcc3074b6ad22
Instruction Fuzzy Hash: AB21AE76E00619ABCB14EF49D841BAAB7B4FB84324F00466EED1663780DB396D10CB94

Function 004E5D00 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(0055D560,00000000,00000000), ref: 004E5D47

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction ID: 3af1858aaf6aa964ebdd9f4359c5c99147492c850a3065a18f0c0dee6211d041
Opcode Fuzzy Hash: 3d8916a0f3a5560b99d21513aef90176b581373bb7b6b0032725707bac5390a9
Instruction Fuzzy Hash: A0110EB1D04B449BE3208F28DD0A757BBF0EB00B28F10471EE850573C1E3BA6A4887E2

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4c9de15bf43b7906aab7ed6efc04c82af185101d7b74466eda9590404471e6f8
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 4c9de15bf43b7906aab7ed6efc04c82af185101d7b74466eda9590404471e6f8
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044A65A Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,000000FF,00000000), ref: 0044A69B

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 44fe68ec2fca24d705c4288583a30094579fd4d4051ae38cb78614132530c581
Instruction ID: 9689b7dccde3e7d2c1426315cc49502dff6dd5535dcc2f3da2dc3831567fdc71
Opcode Fuzzy Hash: 44fe68ec2fca24d705c4288583a30094579fd4d4051ae38cb78614132530c581
Instruction Fuzzy Hash: 4CF0E0311905246BFB216A66DC05B5B375CAF41760F1E8117EC84EB190CA3CDC3146EE

Function 00406840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406853

Part of subcall function 00431F7B: FindNextFileW.KERNELBASE(?,?,?,00406858,?,?,?,?,0040691A,?,?,?,00000000,?,?), ref: 00431F84

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction ID: f155dccb83496c4d8f98fbb14974b26749813e83e467fdfa34ea523ab42003ff
Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction Fuzzy Hash: 63D05E22701520118D24752738085AF06498DC66A8A42447FB84AB32C2EA2D8C0311AD

Function 004466D5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004466DC

Memory Dump Source

Source File: 00000000.00000002.1963629538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1963603313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963754539.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963789360.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816103.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963845295.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963871656.00000000007EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964461391.00000000009B2000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_plTAoSCew2.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction ID: ccf5b3b5ee64302dd7184922bc8d264c22512182c10063c293431932d1ea205a
Opcode Fuzzy Hash: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction Fuzzy Hash: 13E09AB2C0020D9ADB00DFD5C452BEFBBB8AB08315F50446BA205E6181EB789748CBE5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report plTAoSCew2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_35771a6693d2f9ed017f28b56de9aedffce803d_f4fd270f_51467a9a-3e89-495a-973b-ac70eee27268\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_35771a6693d2f9ed017f28b56de9aedffce803d_f4fd270f_e476fb89-b538-4349-955e-cbfc95808757\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_plTAoSCew2.exe_b578f245089fdb92c49ca29b61d78b5de94bd_4cd93bc8_d4836472-6356-48f9-9aaa-e95ab3a9b742\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D82.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3013.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3052.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3774.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER393A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39F6.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A26.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A63.tmp.WERInternalMetadata.xml

Windows Analysis Report
plTAoSCew2.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre