Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1460423
MD5:	b7e7f713ce1c717b6ae28904971e37e5
SHA1:	c18c91d091956967f5937ce5bd1555ea6494309f
SHA256:	f44b54751b7158902476013aed1fbcfec96bc0ab19b3303d088dec97f418885e
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Steals Internet Explorer cookies

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4536 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B7E7F713CE1C717B6AE28904971E37E5)

schtasks.exe (PID: 6900 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6444 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MPGPH131.exe (PID: 3308 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: B7E7F713CE1C717B6AE28904971E37E5)

WerFault.exe (PID: 7588 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 824 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 7112 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: B7E7F713CE1C717B6AE28904971E37E5)

RageMP131.exe (PID: 7264 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: B7E7F713CE1C717B6AE28904971E37E5)

RageMP131.exe (PID: 7620 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: B7E7F713CE1C717B6AE28904971E37E5)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\EfSAyduNP94O7VkIcUcjXr_.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4536	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 3308	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 3308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 7112	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7264	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 7620	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 4536, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.7 - Destination IP: 77.91.77.66

Timestamp:	06/21/24-00:21:07.716237
SID:	2046269
Source Port:	49701
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.7 - Destination IP: 77.91.77.66

Timestamp:	06/21/24-00:21:18.191477
SID:	2046269
Source Port:	49702
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.7

Timestamp:	06/21/24-00:21:22.433823
SID:	2046266
Source Port:	58709
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.7 - Destination IP: 77.91.77.66

Timestamp:	06/21/24-00:21:04.001309
SID:	2049060
Source Port:	49701
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.7

Timestamp:	06/21/24-00:21:08.912466
SID:	2046266
Source Port:	58709
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.7

Timestamp:	06/21/24-00:21:09.145970
SID:	2046267
Source Port:	58709
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.7

Timestamp:	06/21/24-00:21:29.885372
SID:	2046266
Source Port:	58709
Destination Port:	49721
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.7

Timestamp:	06/21/24-00:21:04.598857
SID:	2046266
Source Port:	58709
Destination Port:	49701
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.7

Timestamp:	06/21/24-00:21:08.254846
SID:	2046267
Source Port:	58709
Destination Port:	49701
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.7

Timestamp:	06/21/24-00:21:09.129736
SID:	2046267
Source Port:	58709
Destination Port:	49702
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 77.91.77.66 - Destination IP: 192.168.2.7

Timestamp:	06/21/24-00:21:08.889682
SID:	2046266
Source Port:	58709
Destination Port:	49702
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://77.91.77.81/mine/amadka.exe	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exe	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exeE	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/mine/amadka.exerisepro3J	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exep	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exen	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/lenin.exe	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_004C6B00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		14_2_004C6B00

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49725 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C6000 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	14_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	14_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	14_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	14_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	14_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	14_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	14_2_004938D0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.7:49701 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.7:49701
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.7:49701 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.7:49701
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.7:49702
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.7:49703
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.7:49702
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 77.91.77.66:58709 -> 192.168.2.7:49703
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.7:49702 -> 77.91.77.66:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.7:49716
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 77.91.77.66:58709 -> 192.168.2.7:49721

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 77.91.77.66 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 77.91.77.66:58709

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 172.67.75.166 172.67.75.166
Source: Joe Sandbox View	IP Address: 77.91.77.66 77.91.77.66

Source: Joe Sandbox View

ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.66

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004C7B00 recv,setsockopt,recv,WSAGetLastError,recv,recv,setsockopt,recv,recv,recv,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,Sleep,Sleep,

0_2_004C7B00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe
Source: MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exeE
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exep
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exe
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/lenin.exen
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exerisepro3J
Source: Amcache.hve.21.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1252876306.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1294004431.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000F.00000003.1294088860.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1408057987.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000011.00000003.1419406208.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1530238789.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000016.00000003.1503411648.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596034104.000000000055D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33Ap
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33K
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33SE
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33i
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33z
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/n
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/w
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33J
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33r
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/&
Source: file.exe, 00000000.00000002.1408683703.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: file.exe, 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1252876306.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1294004431.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000F.00000003.1294088860.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1408057987.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000011.00000003.1419406208.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1530238789.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000016.00000003.1503411648.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596034104.000000000055D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E1A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.335
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33o
Source: file.exe, 00000000.00000002.1408683703.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33s
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/y
Source: file.exe, 00000000.00000002.1408683703.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33%
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33h
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t._
Source: file.exe, 00000000.00000002.1408683703.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, EfSAyduNP94O7VkIcUcjXr_.zip.14.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT-
Source: MPGPH131.exe, 0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTMP=C:
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTOCESSOR_IDENTIFIER=Intel%q
Source: MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTv
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.14.dr	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot33
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botB
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botL
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botO
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botZ
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botq
Source: MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.y
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1419793250.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1423274122.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/g
Source: MPGPH131.exe, 0000000E.00000003.1420362412.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1419793250.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1423274122.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.14.dr, D87fZN3R3jFeplaces.sqlite.15.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MPGPH131.exe, 0000000E.00000003.1420362412.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1419793250.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E8B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1423274122.00000000057A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#
Source: MPGPH131.exe, 0000000E.00000003.1420362412.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1419793250.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1423274122.00000000057A1000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.14.dr, D87fZN3R3jFeplaces.sqlite.15.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.7:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.7:49725 version: TLS 1.2

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 14_2_004E5FF0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,705374A0,DeleteObject,DeleteObject,ReleaseDC,

14_2_004E5FF0

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049F0D0	0_2_0049F0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004AA200	0_2_004AA200
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049D3A0	0_2_0049D3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053F550	0_2_0053F550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FAD00	0_2_004FAD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049AF60	0_2_0049AF60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043C960	0_2_0043C960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043A928	0_2_0043A928
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004371A0	0_2_004371A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044036F	0_2_0044036F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A4320	0_2_004A4320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00458BB0	0_2_00458BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004963B0	0_2_004963B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EEC40	0_2_004EEC40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EFC40	0_2_004EFC40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534D40	0_2_00534D40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00546D20	0_2_00546D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00545DE0	0_2_00545DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042F580	0_2_0042F580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00452610	0_2_00452610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A3610	0_2_004A3610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00458E30	0_2_00458E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004986B0	0_2_004986B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00547760	0_2_00547760
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F2FD0	0_2_004F2FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E77E0	0_2_004E77E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0044002D	14_2_0044002D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004DF030	14_2_004DF030
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0049F0D0	14_2_0049F0D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004AA200	14_2_004AA200
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0049D3A0	14_2_0049D3A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004963B0	14_2_004963B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00490440	14_2_00490440
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004DE430	14_2_004DE430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0053F550	14_2_0053F550
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004D7600	14_2_004D7600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004986B0	14_2_004986B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0040B8E0	14_2_0040B8E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00481C10	14_2_00481C10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004FAD00	14_2_004FAD00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00493F40	14_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0049AF60	14_2_0049AF60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004DFF00	14_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00493080	14_2_00493080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004371A0	14_2_004371A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0044036F	14_2_0044036F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004A4320	14_2_004A4320
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004845E0	14_2_004845E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0042F580	14_2_0042F580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004A3610	14_2_004A3610
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_005486C0	14_2_005486C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00547760	14_2_00547760
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004E77E0	14_2_004E77E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004547BF	14_2_004547BF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0043C960	14_2_0043C960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0043A928	14_2_0043A928
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0044DA86	14_2_0044DA86
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00458BB0	14_2_00458BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004EEC40	14_2_004EEC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004EFC40	14_2_004EFC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00534D40	14_2_00534D40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00546D20	14_2_00546D20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00545DE0	14_2_00545DE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00458E30	14_2_00458E30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00541F00	14_2_00541F00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004F2FD0	14_2_004F2FD0

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0041ACE0 appears 86 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0041ACE0 appears 77 times

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 824

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000000.1250380943.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs file.exe
Source: file.exe, 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedotnet.exe6 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981028117541766
Source: file.exe	Static PE information: Section: ZLIB complexity 0.9910126879699248
Source: file.exe	Static PE information: Section: ZLIB complexity 0.990234375
Source: file.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981028117541766
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9910126879699248
Source: RageMP131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.990234375
Source: RageMP131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981028117541766
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9910126879699248
Source: MPGPH131.exe.0.dr	Static PE information: Section: ZLIB complexity 0.990234375
Source: MPGPH131.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/33@2/3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004E77E0 CopyFileA,GetLastError,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,

0_2_004E77E0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4828:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3308

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1252876306.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1294004431.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000F.00000003.1294088860.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1408057987.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000011.00000003.1419406208.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1530238789.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000016.00000003.1503411648.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596034104.000000000055D000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1252876306.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1294004431.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000F.00000003.1294088860.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1408057987.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000011.00000003.1419406208.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1530238789.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000016.00000003.1503411648.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596034104.000000000055D000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: MPGPH131.exe, 0000000E.00000003.1436387408.00000000057A5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1420287683.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1420362412.000000000578D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1423274122.000000000578D000.00000004.00000020.00020000.00000000.sdmp, XV6CMo7Jg4S7Login Data For Account.14.dr, diymrzMDsfMULogin Data.14.dr, 4k4Hzk2ExswRLogin Data.14.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 824
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: file.exe

Static file information: File size 3288080 > 1048576

Source: file.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x26b400

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_004CF280

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .themida
Source: file.exe	Static PE information: section name: .boot
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name:
Source: RageMP131.exe.0.dr	Static PE information: section name: .themida
Source: RageMP131.exe.0.dr	Static PE information: section name: .boot
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name:
Source: MPGPH131.exe.0.dr	Static PE information: section name: .themida
Source: MPGPH131.exe.0.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064E8B4 push 5171531Fh; mov dword ptr [esp], ebp	0_2_008CC8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064E8B4 push edi; mov dword ptr [esp], ebx	0_2_008CC8C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00433F59 push ecx; ret	0_2_00433F6C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0064E8B4 push 5171531Fh; mov dword ptr [esp], ebp	14_2_008CC8C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0064E8B4 push edi; mov dword ptr [esp], ebx	14_2_008CC8C4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00433F59 push ecx; ret	14_2_00433F6C

Source: file.exe	Static PE information: section name: entropy: 7.974899357034606
Source: RageMP131.exe.0.dr	Static PE information: section name: entropy: 7.974899357034606
Source: MPGPH131.exe.0.dr	Static PE information: section name: entropy: 7.974899357034606

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\file.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-36643
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep			graph_14-53648

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-36642
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_14-53669

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_14-46125
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-36788

Source: C:\Users\user\Desktop\file.exe TID: 6348	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6348	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3216	Thread sleep count: 81 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6756	Thread sleep count: 83 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7268	Thread sleep count: 136 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7624	Thread sleep count: 45 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C6000 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004C6000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_00432022
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004E6770
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	0_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	14_2_004C6000
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004E6770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	14_2_004E6770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,	14_2_00493F40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	14_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	14_2_00431F9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	14_2_00432022
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	14_2_004938D0

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 14_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

14_2_004DFF00

Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Dk&Ven_VMware&P
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra Change Transaction PasswordVMware20,11696492231
Source: MPGPH131.exe, 0000000E.00000002.1649901501.0000000005BC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}}C
Source: MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&NE
Source: Amcache.hve.21.dr	Binary or memory string: vmci.sys
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: comVMware20,11696492231o
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXn
Source: Amcache.hve.21.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.21.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual RAM
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.21.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.21.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: MPGPH131.exe, 0000000E.00000002.1649769976.00000000057A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_9C3F3566
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual USB Mouse
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tive Brokers - non-EU EuropeVMware20,11696492231
Source: RageMP131.exe, 00000016.00000003.1528744564.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.21.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MPGPH131.exe, 0000000E.00000002.1649769976.0000000005760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}L~
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: formVMware20,11696492231
Source: Amcache.hve.21.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492
Source: file.exe, 00000000.00000002.1408683703.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000g
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r global passwords blocklistVMware20,11696492231
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Amcache.hve.21.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.21.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: file.exe, 00000000.00000002.1408683703.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000@Z
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,1169649223
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT service, encrypted_token FROM token_servicerr global passwords blocklistVMware20,11696492231
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&)8:
Source: Amcache.hve.21.dr	Binary or memory string: VMware
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: MPGPH131.exe, 0000000E.00000002.1649769976.0000000005760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\User Data\bmikpgodpkclnkgmnpphehdgcimmided\CURRENT}z.
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o.inVMware20,11696492231~
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.21.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pageformVMware20,11696492231
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}qE
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: RageMP131.exe, 00000016.00000003.1528744564.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Amcache.hve.21.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Amcache.hve.21.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.21.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Amcache.hve.21.dr	Binary or memory string: VMware VMCI Bus Device
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Amcache.hve.21.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116(
Source: RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnIA
Source: RageMP131.exe, 00000011.00000002.1531975508.0000000000E1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ccount.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.21.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.21.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.21.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.21.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.21.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000002.1408683703.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: MPGPH131.exe, 0000000E.00000002.1649769976.0000000005760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\User Data\igkpcodhieompeloncfnbekccinhapdb\CURRENT
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Amcache.hve.21.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: MPGPH131.exe, 0000000E.00000003.1439227196.0000000005BD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rootpagecomVMware20,11696492231o
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Amcache.hve.21.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MBy5KfxI1GpwWeb Data.14.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: MPGPH131.exe, 0000000E.00000003.1320967567.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}mD

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort			Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00438A64

Source: C:\Users\user\Desktop\file.exe

0_2_004CF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C6D80 mov eax, dword ptr fs:[00000030h]	0_2_004C6D80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004C6D80 mov eax, dword ptr fs:[00000030h]	14_2_004C6D80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00493F40 mov eax, dword ptr fs:[00000030h]	14_2_00493F40

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004E9A70 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

0_2_004E9A70

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00438A64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0043451D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00438A64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_004CF280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 14_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		14_2_004CF280

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_004531CA
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0044B1B1
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004532F3
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00452B5A
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_004533F9
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004534CF
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00452D5F
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00452E51
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00452E06
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00452EEC
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452F77
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0044B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	14_2_004DFF00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	14_2_004531CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	14_2_0044B1B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_004532F3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	14_2_004533F9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_004534CF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	14_2_0044B734
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	14_2_00452B5A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	14_2_00452D5F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	14_2_00452E51
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	14_2_00452E06
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	14_2_00452EEC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_00452F77

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0043361D GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_0043361D

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

14_2_004DFF00

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

14_2_004DFF00

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.21.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\EfSAyduNP94O7VkIcUcjXr_.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\walletsFo
Source: file.exe, 00000000.00000002.1413592341.0000000005859000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty Extension
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\Autofill
Source: file.exe, 00000000.00000002.1413592341.0000000005859000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: Exodus_E
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json2Vo
Source: MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsN16l7
Source: MPGPH131.exe, 0000000E.00000002.1649769976.0000000005760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger LivealV

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\logins.json	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\places.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\signons.sqlite	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

File read: C:\Users\user\AppData\Local\Temp\trixyTk4mNNg5wnH2\Cookies\Chrome_Default.txt

Jump to behavior

Source: Yara match	File source: 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3308, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 3308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\EfSAyduNP94O7VkIcUcjXr_.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	1 Credentials In Files	1 Account Discovery	Remote Desktop Protocol	21 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Virtualization/Sandbox Evasion	Cached Domain Credentials	351 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	13 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	47%	ReversingLabs	Win32.Trojan.RiseProStealer
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	47%	ReversingLabs	Win32.Trojan.RiseProStealer

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://77.91.77.81/mine/amadka.exe	100%	Avira URL Cloud	phishing
https://ipinfo.io:443/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://t.me/risepro_botB	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTv	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exe	100%	Avira URL Cloud	phishing
https://t.me/risepro_botL	0%	Avira URL Cloud	safe
https://db-ip.com/	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33J	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.335	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exeE	100%	Avira URL Cloud	phishing
https://t.me/risepro	0%	Avira URL Cloud	safe
https://t.me/risepro_botZ	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33K	0%	Avira URL Cloud	safe
https://t.y	0%	Avira URL Cloud	safe
https://ipinfo.io/y	0%	Avira URL Cloud	safe
http://77.91.77.81/mine/amadka.exerisepro3J	100%	Avira URL Cloud	phishing
https://t.me/risepro_botO	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33h	0%	Avira URL Cloud	safe
https://t.me/risepro_botisepro_bot	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTMP=C:	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33o	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33r	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT-	0%	Avira URL Cloud	safe
https://t.me/risepro_bot33	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/go.exep	100%	Avira URL Cloud	phishing
https://ipinfo.io/widget/demo/8.46.123.33s	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://db-ip.com/n	0%	Avira URL Cloud	safe
https://ipinfo.io/Mozilla/5.0	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exen	100%	Avira URL Cloud	phishing
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://t.me/risepro_bot	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33z	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33Ap	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33SE	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://db-ip.com/w	0%	Avira URL Cloud	safe
https://support.mozilla.org	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
http://77.91.77.81/cost/lenin.exe	100%	Avira URL Cloud	phishing
https://db-ip.com/demo/home.php?s=8.46.123.33i	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORTOCESSOR_IDENTIFIER=Intel%q	0%	Avira URL Cloud	safe
https://t._	0%	Avira URL Cloud	safe
https://t.me/risepro_botq	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33%	0%	Avira URL Cloud	safe
https://ipinfo.io/&	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		unknown
db-ip.com	172.67.75.166	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/8.46.123.33	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.91.77.81/mine/amadka.exe	MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33J	MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	file.exe, 00000000.00000002.1408683703.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTv	MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botL	MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exe	file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://t.me/risepro_botB	RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/	RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exeE	MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ipinfo.io/widget/demo/8.46.123.335	RageMP131.exe, 00000016.00000002.1596888366.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botZ	MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	false	URL Reputation: safe	unknown
https://t.y	MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33K	RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro	RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botO	file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/y	MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E81000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/mine/amadka.exerisepro3J	MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	false	URL Reputation: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33	file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33o	MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botisepro_bot	RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTMP=C:	MPGPH131.exe, 0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33r	MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33h	RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	D87fZN3R3jFeplaces.sqlite.0.dr	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot33	MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT-	MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exep	MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	file.exe, 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1252876306.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1294004431.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000F.00000003.1294088860.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1408057987.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000011.00000003.1419406208.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1530238789.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000016.00000003.1503411648.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596034104.000000000055D000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.21.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33s	file.exe, 00000000.00000002.1408683703.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT	file.exe, 00000000.00000002.1408683703.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, EfSAyduNP94O7VkIcUcjXr_.zip.14.dr	false	Avira URL Cloud: safe	unknown
https://db-ip.com/n	RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/Mozilla/5.0	file.exe, 00000000.00000002.1408683703.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596888366.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	false	URL Reputation: safe	unknown
https://t.me/risepro_bot	RageMP131.exe, 00000016.00000002.1596888366.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.14.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exen	MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33z	RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	file.exe, MPGPH131.exe	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33Ap	RageMP131.exe, 00000011.00000002.1531975508.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33SE	MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/w	MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	file.exe, 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1252876306.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1294004431.0000000002840000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000F.00000003.1294088860.0000000002850000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1408057987.000000000055D000.00000002.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000011.00000003.1419406208.0000000002860000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000011.00000002.1530238789.000000000055D000.00000002.00000001.01000000.00000007.sdmp, RageMP131.exe, 00000016.00000003.1503411648.0000000002840000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000016.00000002.1596034104.000000000055D000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.0.dr	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	MPGPH131.exe, 0000000E.00000003.1435312105.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000003.1424968806.0000000005BE8000.00000004.00000020.00020000.00000000.sdmp, Bafr0LqMPV7GWeb Data.14.dr, h5oY31u6hqY9Web Data.14.dr, oqtSf5YllwSpWeb Data.14.dr	false	URL Reputation: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33i	MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/lenin.exe	file.exe, 00000000.00000002.1408683703.000000000100F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://t.me/RiseProSUPPORTOCESSOR_IDENTIFIER=Intel%q	RageMP131.exe, 00000011.00000002.1531975508.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t._	MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D7A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botq	RageMP131.exe, 00000011.00000002.1531975508.0000000000E46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/&	MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33%	MPGPH131.exe, 0000000F.00000002.1411349896.0000000000D5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
172.67.75.166	db-ip.com	United States	13335	CLOUDFLARENETUS	false
77.91.77.66	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460423
Start date and time:	2024-06-21 00:20:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@12/33@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 62% Number of executed functions: 31 Number of non-executed functions: 64
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
00:21:03	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
00:21:03	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
00:21:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
00:21:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
19:31:03	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
172.67.75.166	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	https://curious-kringle-id4964-024b3b3.netlify.app/form.html	Get hash	malicious	Unknown	Browse
	4Ip0IVHqJ3.exe	Get hash	malicious	RisePro Stealer	Browse
	https://gacw-no-reply-restriction-appeal-case.netlify.app/feedback_id_38258467296/	Get hash	malicious	Unknown	Browse
	http://rules-prohibiting-violative-advertisi.netlify.app/appeal_case_ID_78234127826/	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Evo-gen.23207.8804.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	jv9lMYVHh0.exe	Get hash	malicious	RisePro Stealer	Browse
	5i5Cl02eCU.exe	Get hash	malicious	RisePro Stealer	Browse
77.91.77.66	plTAoSCew2.exe	Get hash	malicious	RisePro Stealer	Browse
	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse
	AlCsIOd0pd.exe	Get hash	malicious	RisePro Stealer	Browse
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	PsHQsuTG0H.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	plTAoSCew2.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	PsHQsuTG0H.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	34.117.186.192
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
db-ip.com	plTAoSCew2.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.26.5.15
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	104.26.4.15
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	plTAoSCew2.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	AlCsIOd0pd.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	77.91.77.81
	setup.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	77.91.77.81
	FN MultiHack v2.exe	Get hash	malicious	RedLine	Browse	77.91.77.6
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	77.91.77.66
	https://drive.google.com/file/d/1SCCeBL3Md8Sct7wQF5bfbtLysFqXCW6y/view?ts=667387ac	Get hash	malicious	Unknown	Browse	77.91.77.5
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	PsHQsuTG0H.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	plTAoSCew2.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	PsHQsuTG0H.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments	Get hash	malicious	Unknown	Browse	34.117.239.71
	https://my.visme.co/v/pvmd79je-dj6mqv	Get hash	malicious	Unknown	Browse	34.117.77.79
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192
	D44CPdpkNk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
CLOUDFLARENETUS	http://metaumskelogin.gitbook.io/	Get hash	malicious	Unknown	Browse	172.64.147.209
	http://a.additive.cloudns.org/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://cloudflare-6s0.pages.dev/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://loenwe-hopeagia-noprobs.pages.dev/2606:4700:310c::ac42:2ef9	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://dark-pine.mecayok955.workers.dev/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://818xg.chumeng.link/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://meatamask-loginn.gitbook.io/	Get hash	malicious	Unknown	Browse	172.64.147.209
	http://www.ladesellerburasi.com.tr/	Get hash	malicious	Unknown	Browse	104.21.66.90
	http://sigmaalphalambda.org	Get hash	malicious	Unknown	Browse	104.17.24.14
	plTAoSCew2.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	plTAoSCew2.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	7rA1iX60wh.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	Form_Ver-18-13-38.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	34.117.186.192 172.67.75.166
	PNO3otPYOa.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	YnsEArPlqx.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	Invoice.docm	Get hash	malicious	Unknown	Browse	34.117.186.192 172.67.75.166
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	34.117.186.192 172.67.75.166
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	34.117.186.192 172.67.75.166
	setup.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	setup.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3288080
Entropy (8bit):	7.9625452806049735
Encrypted:	false
SSDEEP:	49152:TrVO6osi6tBGXBfiiwGNBUI7xScqc4sgUFXtOOli2mgIJs7UvYv5:Tdi6HGXNlwyBdn40gOl5IJKuYx
MD5:	B7E7F713CE1C717B6AE28904971E37E5
SHA1:	C18C91D091956967F5937CE5BD1555EA6494309F
SHA-256:	F44B54751B7158902476013AED1FBCFEC96BC0AB19B3303D088DEC97F418885E
SHA-512:	70BC16BF80F7F9A9A03153D63B64D77A9512DB2CBC89C7B367696F555C64C903782BD5FB6798D489C53527616DC2BB410B10564527A8A22DD5AFCFB97621B7FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X.X...........@...........................~.....[.2......................................a..........8.....................~..............................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..>..........x..............`....boot.....&...X...&..x..............`..`.reloc........~......,2................@................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_cf4e7bfd48f2a6b37dc7526592834c22e9a43fc_f4fd270f_a89dfd47-cc32-4b15-9bfd-9524009e54c9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0493647040408818
Encrypted:	false
SSDEEP:	192:vAMVlKaKzI8SH0M8rr6E6jjyZrofxjPzuiFBZ24IO8q6t:o6peI/UM8rCjrPzuiFBY4IO81
MD5:	5588A2AE7D8C28D4CABCEE4B37B30A51
SHA1:	ABAA352E66BD3FA5A52AB345C064FAC517CF9A52
SHA-256:	167F49EFBAD7761D5629F8988B7D28E914E47F2A9A34B7B80DB990D3450C738B
SHA-512:	C6C0F7A319305CAB5ED146361B80FB83FBE23A16E86F7BF9D0881A0E0B2E0A11566070DED06063931CDC2AE0A37BAF519C5841F4098C7E6BA4AFC10EAB94D50E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.9.9.8.4.7.1.4.0.8.2.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.9.9.8.4.8.9.2.2.0.6.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.8.9.d.f.d.4.7.-.c.c.3.2.-.4.b.1.5.-.9.b.f.d.-.9.5.2.4.0.0.9.e.5.4.c.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.9.f.5.9.6.8.-.b.2.9.1.-.4.b.8.4.-.b.2.e.6.-.3.c.d.2.2.d.1.f.c.5.9.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.d.o.t.n.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.e.c.-.0.0.0.1.-.0.0.1.4.-.f.9.1.0.-.4.c.2.3.6.0.c.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.a.4.3.5.a.e.9.1.a.7.4.f.b.4.a.6.8.7.3.2.6.5.f.3.a.4.9.d.2.7.0.0.0.0.0.9.0.4.!.0.0.0.0.c.1.8.c.9.1.d.0.9.1.9.5.6.9.6.7.f.5.9.3.7.c.e.5.b.d.1.5.5.5.e.a.6.4.9.4.3.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBC0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jun 20 23:30:48 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103932
Entropy (8bit):	2.0402435309661335
Encrypted:	false
SSDEEP:	384:9z30VaFtvY6y5X4+fP+61uxV7fuMg1y/EnAfpEcv9C3QPEn/ReB7:9zEVaFtvAsfmrLQ
MD5:	ABC0C4E11E8C795631C2E9B20C5E9EF5
SHA1:	709EF7E245CE577544A9A4DEE0DDA78B27B1E5CB
SHA-256:	16A1E6D25C5571C5D5355074BEBDD1E7A66FF3C46F2C8E78FE6A8D0F6ADC0586
SHA-512:	60105E39CE93DF7DE445934E060218D5BC8E2C9E15D5A0C5060B7D422A1F67BD87D0FB56850DFC2FBDD236CDF0B064418B4DF7987C628212ED796094E4F5E041
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........tf....................................l....#...........L..........`.......8...........T............I..,L...........#...........%..............................................................................eJ.......&......GenuineIntel............T...........O.tf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD16E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6372
Entropy (8bit):	3.7298472600841532
Encrypted:	false
SSDEEP:	192:R6l7wVeJZuF6/yIDYiJJ2yAprR889b8Twsf0yP0m:R6lXJK66IDYaJ2fp8TDfxJ
MD5:	37CA9929A7981A7357F65B1F8E11B3FD
SHA1:	499C6816EAA154B614DB77258754CB77F2D15113
SHA-256:	69D31002AB78152967F7552B706B97767E9BE13CCA4A06A7C65E2065EBD403E1
SHA-512:	F9628B2999ABE446AEBE42582D8F84CB554A7FD69B77715F8B117E74BCF03AE0D8E5A5860482322F2B14C4E2414283C759A25623A06B52CF2D3296CAB33B60E5
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.3.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1AD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.523103053377153
Encrypted:	false
SSDEEP:	48:cvIwWl8zsXJg77aI9XHjoWpW8VYNYm8M4JHYFX+q8iBq8Onrzrd:uIjf5I7pHjB7VBJ2g8+rzrd
MD5:	BDC76BD941D7A30826A26B7311421549
SHA1:	BB43E28F58F6D6F3FE5121CF3C699BBA3582770A
SHA-256:	2F3589AFDC66A5E6B252FE3A764E350E9978C208087AF547613C23A88F9014B2
SHA-512:	AFF8BE11C8D455F69FD866B070E3819E034DD5B1AD893E6A5EE196AFB7C0797FF847BFEE2977926E9D1315C4E12790317D0AA510343411F0DB74215ACCFCC184
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="376713" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3288080
Entropy (8bit):	7.9625452806049735
Encrypted:	false
SSDEEP:	49152:TrVO6osi6tBGXBfiiwGNBUI7xScqc4sgUFXtOOli2mgIJs7UvYv5:Tdi6HGXNlwyBdn40gOl5IJKuYx
MD5:	B7E7F713CE1C717B6AE28904971E37E5
SHA1:	C18C91D091956967F5937CE5BD1555EA6494309F
SHA-256:	F44B54751B7158902476013AED1FBCFEC96BC0AB19B3303D088DEC97F418885E
SHA-512:	70BC16BF80F7F9A9A03153D63B64D77A9512DB2CBC89C7B367696F555C64C903782BD5FB6798D489C53527616DC2BB410B10564527A8A22DD5AFCFB97621B7FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|......X.X...........@...........................~.....[.2......................................a..........8.....................~..............................p...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@....rsrc...8...........................@..@ X........r..................@..B.idata.......`.......r..............@....tls.........p.......v...................themida..>..........x..............`....boot.....&...X...&..x..............`..`.reloc........~......,2................@................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\EfSAyduNP94O7VkIcUcjXr_.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	2801
Entropy (8bit):	7.729945239782429
Encrypted:	false
SSDEEP:	48:9Rae1+D0JGAA43YUxDWfVb4jotsWtqKghBks6n3KJ6xkvOkfcw:L+wJGBgYU1OVbu8EKgIs63KJV
MD5:	2A865D6667C48785EAA9A61D9353EB0F
SHA1:	C572FD560766F21F22440E076683909AD2C79296
SHA-256:	8F4CC4988FBFCAD8509D197D1898482CA2B27EA2CCDCAB36067834B67711EEB2
SHA-512:	86F8036538781E28AFD6CBB6D34075467E1A6035EFA893F3EF2492029132A8A9FC28942BB60AABC5207A3A278EF371B6DF0D4708B831D2754FBEF34718BDD652
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\EfSAyduNP94O7VkIcUcjXr_.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........X................Cookies\Chrome_Default.txt....@.@.H..E2o.)...i...f......L....D."e.moutw.8V}...WB..@#("D.F0".4.$.!.....?...Ny.m~.H...@...h....ee.2<..F.jZu..[)=.F.c.2Fh....J..rf...O..... .N...u5..H6[...o?.....e..I...,.i.h._h.F..............g......J'..YV..y....n...kF..uN.@.....i#x...:.eM..n.eT...s.\...S.P..4.ke.8(=...!..F.J..X...MLpL.H.'..[.'...X,........:.C.Hd.%.B....u:W.......n.....{..Fs...],....<.:...Dw.Vo/[.........PK...........X...ut..._.......information.txt}X.o.F.~7...$..oI~Z.M.:.b.Y...,..-.dHr.l...Q...=1..X$....G...6I.!)mZ.~.-.$..{.........fK>n3.)a...!..7....n......2..6.D.6..s:XD.b..el.....~........B.f..0f. .X0...z......{........%W:T..-4...C.G......T7C2.^O.\|U.5.6....)...gw...[..)..y.._...r>{...~..4K?.I.gv....d.0......Ny..l2$.'........U..\|.+9...[.f.T......9z...e......E...}9$...Q....N.?..Q..l+[.s...0!.....O....'`RC..E.U.-o.bI.I....e.n[H..t.`O..&[m....l0:..>.En..Q..N.U..7.h.%...$[.....FU-.

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:L1W7Ubn:5n
MD5:	4589935A0B45FC4928C26958073C6906
SHA1:	21109F32849C1782F97AB0735DC7EB577CC34116
SHA-256:	48F847B59CBCE0543E573E0F387444E5621EE984756076E8F94E8F7E39861E27
SHA-512:	D53CEAFEDF882F26AA79A41F6CD421B983C9D9D2C518E1AABB86E2F92590C38BE709846DBFD2262CA989781394C44DE2AF2370EB9EC0AA768578BF729B4CCB71
Malicious:	false
Preview:	1718930414721

C:\Users\user\AppData\Local\Temp\spanAK6XIXNsn5Nq\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	modified
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\08X6GAad3tnjCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\4k4Hzk2ExswRLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\Bafr0LqMPV7GWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\MBy5KfxI1GpwWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\NQpa6sjCjyVKCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\OeaSQGdKQorHWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\Sa6XQ5SqTeBqWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\XMAM6bJvCsxVHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\XV6CMo7Jg4S7Login Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\_jIgbEVzKGGZHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\diymrzMDsfMULogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\h5oY31u6hqY9Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\oqtSf5YllwSpWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\wvw07oIVwAzfHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\zV4ixzbU2nqVHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyTk4mNNg5wnH2\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	6.01131324322648
Encrypted:	false
SSDEEP:	12:copYx113fB6BN6nWI7F5rYc0xc5LdxW6bNANfO2hmxEBN6no:KzBochYwxhRAxKqJ
MD5:	350448C3F5349CF53811A638AB396DD4
SHA1:	4F2F2B7A09C5975DC4E26164FAF042A66453817D
SHA-256:	1AD8F746DF0D5B92CD87386A8CC59BDFAE5FB183F9BD295482ADD2F7293957AE
SHA-512:	219BF9680276CEE9CD0BBC5A43AD7A429CD936F3E01512EC86EB7DB754C6F53F696854E37D0A5F54957DF632FEB39E8BECA7A41CDE527354DB7DC1B66B644680
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1699083741.1P_JAR.ENC893_djEwQhi70pxk8SYnIsUr5Mx1RafU8aVnOVKREuHIhYZGwf7yYiBTX+/Go9I=_pegY58D3HUBD9QZJcLjavVe+t354dfRkh4996+iwhdQ=...google.com.TRUE./.TRUE.1712302940.NID.ENC893_djEwLw0FxAbtzbuLu4wKVSq+uTnRXrV8Hjm5jygIZpKkr22DX+rtTXvcKjen8Rma/GMurYESAmzjenQyKR9qgVu8k/RaiXiSOiaa/lut8WnwO9d8PkBOTAKSZdFhBtU397xZvK8G5XfAi73fDip21OdwdRp1SNZiUAXp6f0j3VYFGuDV6eIgzT4pVkR12LMGBw+RHof28TQ4kFZOLkO7VAFPVzwW25OZFq13SAlLlyUrl4XcbKetVNOrD9EP/gbXB8k6OopuPJAICB2ZHI4=_pegY58D3HUBD9QZJcLjavVe+t354dfRkh4996+iwhdQ=..

C:\Users\user\AppData\Local\Temp\trixyTk4mNNg5wnH2\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5471
Entropy (8bit):	5.456573546077302
Encrypted:	false
SSDEEP:	96:xRFx5VORZicBpAXiSt3ZRT9UwJM0FPscsANUbg3x:xnwDi8ySSt3PT9UmDVB
MD5:	3162F808C28FC74CC7687F6E4D0DA67C
SHA1:	2DF6A7B1A98BBEA94EA3EB1A10D43095B87BACE2
SHA-256:	75CC2C514D7C17A54880E45C5745A4F700A15E376AE25590D379BF700BA3579E
SHA-512:	F36198424E6154024520376FE570712B427CEE28F027B946AD8DEC5EDDF5E7E55B13FEF4701AEE4451733C44F290AB871D6421A4A51D07D205F94BBC43125F17
Malicious:	false
Preview:	Build: selta..Version: 2.0....Date: Thu Jun 20 18:21:18 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: ba7424f256950ea63618af0f9a7cb086....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user~1\AppData\Local\Temp\trixyTk4mNNg5wnH2....IP: 8.46.123.33..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 134349 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 18:21:18..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [556]..services.exe [624]..lsass.exe [632]..svchost.exe [748]..fontdrvhost.exe [772]..fontdrvh

C:\Users\user\AppData\Local\Temp\trixyTk4mNNg5wnH2\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4170754748717425
Encrypted:	false
SSDEEP:	6144:0cifpi6ceLPL9skLmb0mFSWSPtaJG8nAgex285i2MMhA20X4WABlGuNR5+:Zi58FSWIZBk2MM6AFB3o
MD5:	8E1E1270D2D08921B26814543CAC2F99
SHA1:	36B4346C35A7F779378B37179A38677A03D94371
SHA-256:	FA82048B9506FBB63645FB1A684819A1354A39B9F50E6E9A3A40A52320956481
SHA-512:	34188A0F4E917476705E010DF40DFCC2C2BADDE0087EDE597C41AF884EA102907B49AC666FBD0A3965B72C6EE9B7E341B25FD40EA7C038BD36126617CA15FE0E
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....i...............................................................................................................................................................................................................................................................................................................................................A9..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9625452806049735
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'288'080 bytes
MD5:	b7e7f713ce1c717b6ae28904971e37e5
SHA1:	c18c91d091956967f5937ce5bd1555ea6494309f
SHA256:	f44b54751b7158902476013aed1fbcfec96bc0ab19b3303d088dec97f418885e
SHA512:	70bc16bf80f7f9a9a03153d63b64d77a9512db2cbc89c7b367696f555c64c903782bd5fb6798d489c53527616dc2bb410b10564527a8a22dd5afcfb97621b7fa
SSDEEP:	49152:TrVO6osi6tBGXBfiiwGNBUI7xScqc4sgUFXtOOli2mgIJs7UvYv5:Tdi6HGXNlwyBdn40gOl5IJKuYx
TLSH:	6DE533B4ACE1DB73DEF7253A19571DC325012713CE935A70654FACB3A12824E13AAB2D
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	8596a1a0a1a1b171

Static PE Info

General

Entrypoint:	0x980058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x664C6914 [Tue May 21 09:27:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63814aaf116ba6abb6496ce4bcad24c6

Entrypoint Preview

Instruction
call 00007FEC20ED3AF0h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FEC20ED398Ch
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FEC20ED39F3h
xor eax, eax
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FEC20ED3A87h
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007FEC20ED39AAh
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007FEC20ED393Bh
mov eax, 00000001h
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FEC20ED398Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007FEC20ED39CAh
mov ecx, 00000001h
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007FEC20ED39A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FEC20ED398Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19618b	0x184	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18a000	0x1638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7ec000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x197018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x18369c	0x40
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x15bbc8	0x9d200	0b5966057166f14f792b0661a52e62c9	False	0.9981028117541766	data	7.974899357034606	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x15d000	0x27e32	0x10a00	cdb9a7ba3c41de697f1c02a0819f5afb	False	0.9910126879699248	data	7.921714740120305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x185000	0x4930	0x800	4c73bbaf3b06d3fecdce59d9a8ec47f9	False	0.990234375	data	7.7595853049567465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18a000	0x1638	0x1800	fe6f3fdb9e7e97cba92d8ce4e4fcc95b	False	0.7220052083333334	data	6.54017046361188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x18c000	0x9858	0x7200	e10cc8e287c4710362557422f669d7cc	False	0.9799205043859649	data	7.940612143792499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x196000	0x1000	0x400	1b20e07443fa333ff9692026d1e6c6c2	False	0.3984375	data	3.42439969016873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x197000	0x1000	0x200	54a50a058e0f3b6aa2fe1b22e2033106	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x198000	0x3e8000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x580000	0x26b400	0x26b400	adef47a5fd46533e1142dfe88de3ac44	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x7ec000	0x1000	0x10	f5bc99b71bad9e8a775cc32747e3ca58	False	1.5	GLS_BINARY_LSB_FIRST	2.474601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x18a440	0x1060	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.8838263358778626
RT_GROUP_ICON	0x18b4a0	0x14	data	Russian	Russia	1.05
RT_VERSION	0x18a130	0x310	data	Russian	Russia	0.45408163265306123
RT_MANIFEST	0x18b4b8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	wsprintfA
GDI32.dll	CreateCompatibleBitmap
ADVAPI32.dll	RegQueryValueExA
SHELL32.dll	ShellExecuteA
ole32.dll	CoInitialize
WS2_32.dll	WSAStartup
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders
SETUPAPI.dll	SetupDiEnumDeviceInfo
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/21/24-00:21:07.716237	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49701	58709	192.168.2.7	77.91.77.66
06/21/24-00:21:18.191477	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49702	58709	192.168.2.7	77.91.77.66
06/21/24-00:21:22.433823	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49716	77.91.77.66	192.168.2.7
06/21/24-00:21:04.001309	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49701	58709	192.168.2.7	77.91.77.66
06/21/24-00:21:08.912466	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49703	77.91.77.66	192.168.2.7
06/21/24-00:21:09.145970	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49703	77.91.77.66	192.168.2.7
06/21/24-00:21:29.885372	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49721	77.91.77.66	192.168.2.7
06/21/24-00:21:04.598857	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49701	77.91.77.66	192.168.2.7
06/21/24-00:21:08.254846	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49701	77.91.77.66	192.168.2.7
06/21/24-00:21:09.129736	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49702	77.91.77.66	192.168.2.7
06/21/24-00:21:08.889682	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49702	77.91.77.66	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 21, 2024 00:21:03.982075930 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:03.987093925 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:03.987190008 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:04.001308918 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:04.006155014 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:04.598856926 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:04.653630972 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:07.716237068 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:07.722588062 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.254846096 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.277223110 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.283832073 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.283910036 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.290463924 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.296695948 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.296811104 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.302526951 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.309277058 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.309988976 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.318964005 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.325109005 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.378061056 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:08.378087997 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:08.378267050 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:08.379343987 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:08.379354954 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:08.441593885 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.484045029 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.608400106 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.608869076 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.615401983 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.873218060 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:08.873363018 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:08.874639034 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:08.874645948 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:08.874876976 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:08.889682055 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.912466049 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:08.919302940 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:08.929915905 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:08.935542107 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.966139078 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:08.976505995 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.041207075 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:09.044120073 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:09.050230980 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:09.054567099 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:09.054790974 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:09.061309099 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:09.090089083 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.090207100 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.090678930 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.099611998 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.099611998 CEST	49704	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.099632978 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.099643946 CEST	443	49704	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.117398977 CEST	49705	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:09.117466927 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.117566109 CEST	49705	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:09.117885113 CEST	49705	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:09.117898941 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.129735947 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:09.145970106 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:09.184943914 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:09.200537920 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:09.230683088 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.230720997 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.230772018 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.233150005 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.233171940 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.257275105 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.257318020 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.257378101 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.258821964 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.258836031 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.585522890 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.585628033 CEST	49705	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:09.663549900 CEST	49705	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:09.663590908 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.663990974 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.665801048 CEST	49705	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:09.700472116 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.700618982 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.708504915 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.735774994 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.735824108 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.736377954 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.738382101 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.738487959 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.779894114 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.798491955 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:09.798518896 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.798829079 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:09.801583052 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.801656961 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.801708937 CEST	49705	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:09.802967072 CEST	49705	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:09.802993059 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.803006887 CEST	49705	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:09.803014040 CEST	443	49705	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:09.803623915 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:09.810004950 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:09.841285944 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:10.176826000 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:10.220505953 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.257196903 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:10.304495096 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.307689905 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.307924032 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.307971001 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:10.308240891 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:10.308264017 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.308279037 CEST	49706	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:10.308284998 CEST	443	49706	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.363486052 CEST	49708	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.363531113 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.363626003 CEST	49708	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.363953114 CEST	49708	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.363967896 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.397828102 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.397938967 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.397984982 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:10.398351908 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:10.398370981 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.398384094 CEST	49707	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:10.398391008 CEST	443	49707	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:10.406538010 CEST	49709	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.406577110 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.406639099 CEST	49709	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.406984091 CEST	49709	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.406995058 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.849873066 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.849942923 CEST	49708	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.851304054 CEST	49708	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.851313114 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.851558924 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.852994919 CEST	49708	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.866198063 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.866264105 CEST	49709	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.867533922 CEST	49709	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.867541075 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.867775917 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.868998051 CEST	49709	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:10.896507025 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:10.916497946 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:11.212388992 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:11.212426901 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:11.212497950 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:11.212539911 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:11.212557077 CEST	49708	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:11.212624073 CEST	49709	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:11.212981939 CEST	49709	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:11.212981939 CEST	49709	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:11.212991953 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:11.213000059 CEST	443	49709	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:11.213196993 CEST	49708	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:11.213224888 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:11.213241100 CEST	49708	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:11.213248014 CEST	443	49708	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:11.213413000 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.213481903 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.218297958 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:11.218314886 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:11.481488943 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:11.528738976 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.544634104 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.546626091 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:11.551081896 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:11.591258049 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.654040098 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.660402060 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:11.771323919 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:11.825632095 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.873040915 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.879456043 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:11.900273085 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:11.950615883 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.982069016 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:11.988385916 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.109496117 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.110172987 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.110212088 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.110244989 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.110240936 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.110269070 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.110346079 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.111512899 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.111524105 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.111553907 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.111578941 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.111680031 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.111710072 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.111721039 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.111776114 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.111788034 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.111802101 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.111828089 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.111828089 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.112649918 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.112759113 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.113152027 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.117206097 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.117728949 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.217708111 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.217736959 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.217749119 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.217885017 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.218137026 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.218153000 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.218190908 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.218233109 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.218327045 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.218446016 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.218552113 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.218563080 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.218725920 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.218823910 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.218885899 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.218956947 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.219083071 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.219127893 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.219172001 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.219362020 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.219517946 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.219618082 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.224185944 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.224215031 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.224225998 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.224253893 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.224293947 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.227292061 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.227313042 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.227324009 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.227404118 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.227546930 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.227658987 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.227690935 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.278770924 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.316521883 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.335844994 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.335907936 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.335959911 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.335987091 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.335994005 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.336029053 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.336052895 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.356909037 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.388113976 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.422072887 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.428637028 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.431917906 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.438780069 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.651993990 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.695718050 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.700535059 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.747500896 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.770415068 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.776575089 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:12.785818100 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:12.792001009 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.340682030 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.388034105 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.419598103 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.426402092 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.651695013 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.700550079 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.747891903 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.752868891 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.987402916 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.987454891 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.987467051 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.987478971 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.987503052 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.987526894 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.987560034 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.987611055 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.987751961 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.987763882 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.987806082 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.987811089 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.987850904 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.988221884 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.988272905 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.988285065 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.988322020 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.988430023 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.988501072 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.988538980 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.989188910 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.989212990 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.989224911 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.989236116 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.989264011 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:14.993666887 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.993706942 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:14.993746996 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:15.067603111 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.084228039 CEST	58709	49703	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.105051994 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.105078936 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.105091095 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.105166912 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:15.105200052 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.105215073 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.105246067 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:15.122546911 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:15.138097048 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:15.153688908 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:15.185249090 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:15.192646027 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.419384956 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.466166973 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:15.522898912 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:15.529517889 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.758955956 CEST	58709	49701	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:15.810029984 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:17.587692022 CEST	49701	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:17.746381998 CEST	49703	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:18.191477060 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:18.198064089 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:18.595407009 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:18.637974024 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:20.274576902 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:20.274647951 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:20.281102896 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:20.281145096 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:20.281173944 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:20.281188011 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:20.281199932 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:20.288011074 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:21.836513042 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:21.843755960 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:21.843900919 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:21.864043951 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:21.868949890 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:22.433823109 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:22.481893063 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:23.218944073 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:23.278691053 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:23.341346979 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:23.348391056 CEST	58709	49702	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:23.348473072 CEST	49702	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:23.385351896 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:23.481842995 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:23.484364033 CEST	49717	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:23.484412909 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:23.484538078 CEST	49717	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:23.485640049 CEST	49717	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:23.485656023 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:23.497622967 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:23.505618095 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:23.950298071 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:23.950366974 CEST	49717	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:23.953188896 CEST	49717	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:23.953195095 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:23.953445911 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:24.011492968 CEST	49717	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:24.056502104 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:24.139533997 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:24.139672995 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:24.139724016 CEST	49717	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:24.139916897 CEST	49717	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:24.139938116 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:24.139951944 CEST	49717	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:24.139957905 CEST	443	49717	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:24.142101049 CEST	49718	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:24.142122984 CEST	443	49718	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:24.142225027 CEST	49718	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:24.142760992 CEST	49718	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:24.142772913 CEST	443	49718	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:24.618252039 CEST	443	49718	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:24.618329048 CEST	49718	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:24.619662046 CEST	49718	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:24.619669914 CEST	443	49718	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:24.619920015 CEST	443	49718	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:24.621225119 CEST	49718	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:24.664500952 CEST	443	49718	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:24.783746004 CEST	443	49718	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:24.784120083 CEST	443	49718	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:24.784178019 CEST	49718	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:24.784303904 CEST	49718	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:24.784315109 CEST	443	49718	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:24.784945965 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:24.792228937 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:25.057445049 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:25.108783007 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:25.110162973 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:25.300127983 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:25.300158024 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:25.300257921 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:25.526633978 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:25.578350067 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:28.718981028 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:28.725559950 CEST	58709	49716	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:28.725683928 CEST	49716	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:29.026293039 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:29.032943010 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:29.033113956 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:29.078053951 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:29.085386038 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:29.842473984 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:29.885371923 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:29.885449886 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:30.107268095 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:30.153687000 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:30.278371096 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:30.325869083 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:30.334088087 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:30.334136963 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:30.334216118 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:30.335155010 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:30.335175037 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:30.403887987 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:30.409151077 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:30.987632036 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:30.987720013 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:30.989084005 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:30.989090919 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:30.989871025 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:31.044316053 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:31.050394058 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:31.092544079 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:31.183809996 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:31.183928013 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:31.184068918 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:31.184485912 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:31.184497118 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:31.184514046 CEST	49724	443	192.168.2.7	34.117.186.192
Jun 21, 2024 00:21:31.184520006 CEST	443	49724	34.117.186.192	192.168.2.7
Jun 21, 2024 00:21:31.186647892 CEST	49725	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:31.186680079 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:31.190677881 CEST	49725	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:31.191098928 CEST	49725	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:31.191117048 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:31.896787882 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:31.896899939 CEST	49725	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:31.905579090 CEST	49725	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:31.905606031 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:31.905960083 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:31.907628059 CEST	49725	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:31.948508024 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:32.075598001 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:32.075702906 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:32.075854063 CEST	49725	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:32.081186056 CEST	49725	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:32.081226110 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:32.081273079 CEST	49725	443	192.168.2.7	172.67.75.166
Jun 21, 2024 00:21:32.081280947 CEST	443	49725	172.67.75.166	192.168.2.7
Jun 21, 2024 00:21:32.089000940 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:32.095089912 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:32.356393099 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:32.408634901 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:32.421545982 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:32.428143978 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:32.648624897 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:32.700607061 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:35.763140917 CEST	49721	58709	192.168.2.7	77.91.77.66
Jun 21, 2024 00:21:35.768121958 CEST	58709	49721	77.91.77.66	192.168.2.7
Jun 21, 2024 00:21:35.768208981 CEST	49721	58709	192.168.2.7	77.91.77.66

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 21, 2024 00:21:08.362730026 CEST	62057	53	192.168.2.7	1.1.1.1
Jun 21, 2024 00:21:08.373075962 CEST	53	62057	1.1.1.1	192.168.2.7
Jun 21, 2024 00:21:09.104669094 CEST	51884	53	192.168.2.7	1.1.1.1
Jun 21, 2024 00:21:09.116669893 CEST	53	51884	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 21, 2024 00:21:08.362730026 CEST	192.168.2.7	1.1.1.1	0x9d67	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jun 21, 2024 00:21:09.104669094 CEST	192.168.2.7	1.1.1.1	0x71e5	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 21, 2024 00:21:08.373075962 CEST	1.1.1.1	192.168.2.7	0x9d67	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Jun 21, 2024 00:21:09.116669893 CEST	1.1.1.1	192.168.2.7	0x71e5	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Jun 21, 2024 00:21:09.116669893 CEST	1.1.1.1	192.168.2.7	0x71e5	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Jun 21, 2024 00:21:09.116669893 CEST	1.1.1.1	192.168.2.7	0x71e5	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

https:

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49700	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:20:55 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-20 22:20:55 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 22:20:55 GMT content-type: application/json; charset=utf-8 Content-Length: 319 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 22:20:55 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	34.117.186.192	443	4536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:08 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 22:21:09 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 22:21:09 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 22:21:09 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 22:21:09 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49705	172.67.75.166	443	4536	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:09 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 22:21:09 UTC	657	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 22:21:09 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46E6F3:5FFC_93878F2E:0050_6674AB55_14BFBCBA:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8ygKXkExJH1PQYe7SaJyhUdk3FAebX7A1%2FLFeNSuoREkMuBl3nhuChlFN1aXGC3YER1ftLLQYkOQdcUZuWvuIwoOXN26iPxkHIUda%2Bco%2BfXFoUi13FvhPZw%2Faw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896f2677c98e8c6b-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 22:21:09 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 22:21:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49706	34.117.186.192	443	3308	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:10 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 22:21:10 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 22:21:10 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 22:21:10 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 22:21:10 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49707	34.117.186.192	443	7112	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:10 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 22:21:10 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 22:21:10 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 22:21:10 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 22:21:10 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49708	172.67.75.166	443	3308	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:10 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 22:21:11 UTC	655	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 22:21:10 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E3E32:71E8_93878F2E:0050_6674AB56_14D3C242:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E6hEacCOfEAhUlL%2FSc2xPPDVT7ilnksSRNlty%2FS70j8T2FMSccb6FogWn62xpBSNalp9eGZXzcO3V0q37fdgo9%2F4w3SztGcViPYsOf6HGIMUxXDnpSDDYqc2RA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896f267f584e0c90-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 22:21:11 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 22:21:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49709	172.67.75.166	443	7112	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:10 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 22:21:11 UTC	655	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 22:21:11 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9F24:D138_93878F2E:0050_6674AB56_14BFBCEB:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UsXFsO83lPZ6W1UhPv0Gv3puAz%2BKVCeKAGDHtFdHgWLnT9Nokj8NATK0Wa9NCbUm4tYk0TZaE4EdqpRb4WPiTI5x5XrH%2B6F42efpGpIXv3S%2B02ZH5XRYGPLfXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896f267f8e1b42d4-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 22:21:11 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 22:21:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49717	34.117.186.192	443	7264	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:24 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 22:21:24 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 22:21:24 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 22:21:24 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 22:21:24 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49718	172.67.75.166	443	7264	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:24 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 22:21:24 UTC	655	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 22:21:24 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9E71:2B8C_93878F2E:0050_6674AB64_14D3C444:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TXHITAd3IL4hHuPwjxgE7U5K0Rx5lVpO8cVXwer2s9WrZjHQumwMydok%2BIlVKeDhzTd8hOshjhqD%2FDZ32fXJHh%2BS3FvbqdyqrZSJm5SwpWwNtH5jGxLB1knNGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896f26d55cb2421c-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 22:21:24 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 22:21:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49724	34.117.186.192	443	7620	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:31 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 22:21:31 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 22:21:31 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 22:21:31 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 22:21:31 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49725	172.67.75.166	443	7620	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 22:21:31 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 22:21:32 UTC	659	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 22:21:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9B93:CFF0_93878F2E:0050_6674AB6C_14BFC000:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HkZar8chJfH%2BNQ9W8AIEFox3pP9j03LrI9oVky4jkkf0oLGcWVcFuiGSB7Se5qIIjTzXV%2Bw%2BsAKsQOtWgyDxZUXJtN19%2Ftu8ylDoO4Hu%2BAsrYdzN8e9YPyPIMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896f2702fb6f4310-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 22:21:32 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 22:21:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	18:21:00
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	3'288'080 bytes
MD5 hash:	B7E7F713CE1C717B6AE28904971E37E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:21:02
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xcb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:21:02
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:21:02
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xcb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:21:02
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:21:03
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'288'080 bytes
MD5 hash:	B7E7F713CE1C717B6AE28904971E37E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000E.00000002.1649769976.0000000005796000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000E.00000003.1441139186.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000E.00000002.1649316109.0000000000F2B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.1648923319.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:21:03
Start date:	20/06/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	3'288'080 bytes
MD5 hash:	B7E7F713CE1C717B6AE28904971E37E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:21:16
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'288'080 bytes
MD5 hash:	B7E7F713CE1C717B6AE28904971E37E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:30:46
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 824
Imagebase:	0xde0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:30:48
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	3'288'080 bytes
MD5 hash:	B7E7F713CE1C717B6AE28904971E37E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	8

Executed Functions

Function 004AA200 Relevance: 56.8, APIs: 10, Strings: 11, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 004AA277

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?), ref: 004C613F

Strings

X<b., xrefs: 004B0396
cannot use push_back() with , xrefs: 004B10BB, 004B1333, 004B3367, 004B3558, 004B8296, 004B842E, 004BDFC9, 004BE020, 004BE074, 004BFE23, 004BFFFB, 004C1CD9, 004C1E80, 004C5F5A
Jzv", xrefs: 004BCB48
;Yb., xrefs: 004B26EA
;Yb., xrefs: 004BAF18
;Yb., xrefs: 004B04F0
cannot use operator[] with a string argument with , xrefs: 004B14F5, 004B152D, 004B1580, 004B15B5, 004B15EC, 004B34C2, 004B3500, 004B35B5, 004B83F4, 004B848D, 004BDF6D, 004BE0D4, 004BE129, 004BE17E, 004BE1D9, 004BE22E, 004BE283, 004BE2D8, 004BE32D, 004BE382, 004BFF65, 004BFFA3, 004C0058, 004C1DEA, 004C1E28, 004C1EDD, 004C5EE8, 004C5F20, 004C5FB2
;Yb., xrefs: 004BCCC8
WUa5, xrefs: 004BAC90
;Yb., xrefs: 004B62DD
;Yb., xrefs: 004C47B2

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$Jzv"$WUa5$X<b.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-383699475
Opcode ID: a9177fbbe17572fbd4b84f9919c9dbe39e8faa86fef2cda6b0e8cc26f7163890
Instruction ID: d5c29c46e18a526762dbfc7c8aed9f945ae13eab665394adbd88e65e82b678fb
Opcode Fuzzy Hash: a9177fbbe17572fbd4b84f9919c9dbe39e8faa86fef2cda6b0e8cc26f7163890
Instruction Fuzzy Hash: 29B433B0D052698BDB25CF68C984BEEBBB1BF49304F1081DAD449A7281DB746F84CF95

Function 0049F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0049F224
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049F322
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049F515
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 004A1C76

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32 ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000000), ref: 004A1F5D
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004A348E

Strings

cannot use push_back() with , xrefs: 004A3518
~]d, xrefs: 0049FAC6
cannot use operator[] with a string argument with , xrefs: 004A3571, 004A35C6
;Yb., xrefs: 0049FC4C

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $~]d
API String ID: 2833034228-1763774129
Opcode ID: 7d93ad9b4b1ce352e5d1ee811a148a18318d73da804a40fe56edda9e192c09f8
Instruction ID: 3f98b5ef17dcfaa8f689e4fcb5a5d7fbbd5e2711f2842c60bb6495c93d0a2e70
Opcode Fuzzy Hash: 7d93ad9b4b1ce352e5d1ee811a148a18318d73da804a40fe56edda9e192c09f8
Instruction Fuzzy Hash: 2793DCB4D052A98ADB65CF29C990BEDBBB1BF59304F0081EAD84DA7241DB742BC4CF45

Function 004C7B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000378,0000FFFF,00001006,?,00000008), ref: 004C7BA6
recv.WS2_32(?,00000004,00000002), ref: 004C7BC1
WSAGetLastError.WS2_32 ref: 004C7BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 004C7C43
recv.WS2_32(00000000,0000000C,00000008), ref: 004C7C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004C7D00
recv.WS2_32(00000000,?,00000008), ref: 004C7D1B

Part of subcall function 004C8590: WSAStartup.WS2_32 ref: 004C85BA
Part of subcall function 004C8590: getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
Part of subcall function 004C8590: socket.WS2_32(?,?,?), ref: 004C865D
Part of subcall function 004C8590: connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
Part of subcall function 004C8590: closesocket.WS2_32(00000000), ref: 004C867D
Part of subcall function 004C8590: FreeAddrInfoW.WS2_32(?), ref: 004C868A
Part of subcall function 004C8590: WSACleanup.WS2_32 ref: 004C8690

recv.WS2_32(?,00000004,00000008), ref: 004C7E23
__Xtime_get_ticks.LIBCPMT ref: 004C7E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004C7E38
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004C7EB1
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004C7EB9

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: recv$Sleepsetsockopt$AddrCleanupErrorFreeInfoLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectgetaddrinfosocket
String ID:
API String ID: 3089209366-0
Opcode ID: bf63d13b1ff8512e0977649ea2c4b5d39b1ddf7e820bf7edad5e0a4297d173d9
Instruction ID: b3d54dcccad81d83ab75f13ba9899d4b50e1d8608cabcccfb3508871926cac68
Opcode Fuzzy Hash: bf63d13b1ff8512e0977649ea2c4b5d39b1ddf7e820bf7edad5e0a4297d173d9
Instruction Fuzzy Hash: 9EB1AC71D043089BEB10DBA8CC49BAEBBB1BB54314F24025EE815BB2D2D7785D88DF95

Function 0049AF60 Relevance: 14.1, APIs: 4, Strings: 3, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0049B158
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049B265
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049B458
lstrlen.KERNEL32(?), ref: 0049D22D

Strings

cannot use push_back() with , xrefs: 0049D0EA, 0049D2EC
;Yb., xrefs: 0049BFEE
cannot use operator[] with a string argument with , xrefs: 0049D29C, 0049D353

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-747751661
Opcode ID: c7548e9aab67caa6fd7e4735ddc45b734348763a357b6ffe448b77bd6da819b4
Instruction ID: b2dbe3f5757ef5304a2bca7f4d9e3a7c922558eb406562d1b13ccbd165419304
Opcode Fuzzy Hash: c7548e9aab67caa6fd7e4735ddc45b734348763a357b6ffe448b77bd6da819b4
Instruction Fuzzy Hash: BF2321B0D042688BDB25CF28C9947EDBBB1BF59304F1082EAE449A7281DB746BC4CF55

Function 0049D3A0 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0049D4F4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049D5F2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049D7E5
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049EF32

Strings

cannot use push_back() with , xrefs: 0049EE76, 0049F02B
cannot use operator[] with a string argument with , xrefs: 0049EF9D, 0049EFDB, 0049F08D

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: 5d224bfb82d7c9fcd97c78c1f7bd274914e5a38299a5b7267bf76e394b5648f2
Instruction ID: d38aed82ee4788d52106214de1412b854dd9129e0c255bb6c7140376d04d8967
Opcode Fuzzy Hash: 5d224bfb82d7c9fcd97c78c1f7bd274914e5a38299a5b7267bf76e394b5648f2
Instruction Fuzzy Hash: 570334B0D042688BDB25CF28C9947EEBBB4BF59304F1042EED449A7281EB746B84CF55

Function 004FAD00 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BINARY, xrefs: 004FAF25, 004FAF34, 004FAF4E, 004FAF8E, 004FAF99, 004FAFB1, 004FB003, 004FB004
no such vfs: %s, xrefs: 004FAEB7
NOCASE, xrefs: 004FB02A
sqlite_rename_table, xrefs: 004FB0E4
MATCH, xrefs: 004FB108, 004FB119, 004FB139, 004FB13A, 004FB150
automatic extension loading failed: %s, xrefs: 004FB22C
RTRIM, xrefs: 004FAF68

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: a864fd7dad79a32950e1a3954983aec6090b04f88dbfbe7a85b3d92d191a67f2
Instruction ID: 5912c9be0b5fe0253428befa1510005b8e6d21b15bd6994098c8da1f87b2af15
Opcode Fuzzy Hash: a864fd7dad79a32950e1a3954983aec6090b04f88dbfbe7a85b3d92d191a67f2
Instruction Fuzzy Hash: 510258B0A007089BEB209F15DC4577B7BE4EF51304F14442EEA4A9B391EBB9E944CBC6

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?), ref: 004C613F
FindNextFileA.KERNELBASE(00000000,?), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: a7ad18d51658f77bd61d09f36d0788fbadf79f2108f720d862e139cd03739d85
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: a7ad18d51658f77bd61d09f36d0788fbadf79f2108f720d862e139cd03739d85
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 004C6B00 Relevance: 4.7, APIs: 3, Instructions: 206
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004C6B57
LocalFree.KERNEL32(?), ref: 004C6B86
LocalFree.KERNEL32(?), ref: 004C6C82

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: 1533ca36fc6368f71f1706799fb82bbbf52b30dfe3248a4a7a1959e0c4880e2a
Instruction ID: 6019ec204b0dd747d4126109e6a4f8e7bf51aa55734569d67b400ef60c6c0d13
Opcode Fuzzy Hash: 1533ca36fc6368f71f1706799fb82bbbf52b30dfe3248a4a7a1959e0c4880e2a
Instruction Fuzzy Hash: 6171B171C002489BDB00DFA8C945BEEFBB4EF14314F10826EE851B3391EB786A44DBA5

Function 0053F550 Relevance: 3.5, APIs: 2, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053F705
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053FA07

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 6ae8c637088de4902e6d455990272f9b247a4e20bc2d6b6d02b88d9e5933e8eb
Instruction ID: 1f76d2344d35fe0e13097961589cbfb84b6978ae6f877586e2245b879765d82e
Opcode Fuzzy Hash: 6ae8c637088de4902e6d455990272f9b247a4e20bc2d6b6d02b88d9e5933e8eb
Instruction Fuzzy Hash: E3029C71A04702AFDB18CF29C840B6ABBE4BF88318F14867DE859D7650D774ED94CB92

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
FreeAddrInfoW.WS2_32(?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
FreeAddrInfoW.WS2_32(?), ref: 004C86A5

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 448659506-0
Opcode ID: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 00448910 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902ce7424542a7d6309be3872ecc1540050696f48f214c3cf9d5a8d8ad4329c7
Instruction ID: d4d7462daa34083545f9d93f0c5ebf53bf58a01a885379ada905c47cec286c1a
Opcode Fuzzy Hash: 902ce7424542a7d6309be3872ecc1540050696f48f214c3cf9d5a8d8ad4329c7
Instruction Fuzzy Hash: E2B1F4B0A00245AFFB11DF99C881BAE7BB1FF55304F14015EE414AB392CB78AD81CB69

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 64b94343ee35b0d26e9cca6c242c160ae38be4edcc292f427b63a3fe9f64685c
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: 64b94343ee35b0d26e9cca6c242c160ae38be4edcc292f427b63a3fe9f64685c
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 004E6CA0 Relevance: 6.1, APIs: 4, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE ref: 004E6CFC
GetLastError.KERNEL32 ref: 004E6D07
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 751d59ce9cbdb692ee5bb2d2431e64d06372360fcf2dbebe5d89e7aefb34e6ec
Instruction ID: 241e2f942859b358e1133ab4bf22632851a161ac9c5554c12c2f2fb0b7350d8e
Opcode Fuzzy Hash: 751d59ce9cbdb692ee5bb2d2431e64d06372360fcf2dbebe5d89e7aefb34e6ec
Instruction Fuzzy Hash: DF11CE71A0028496DB205F6A5C08F6A7F60EB22772F64031BD8359B3D4DB3948058759

Function 004D6790 Relevance: 4.8, APIs: 3, Instructions: 278
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 004D6A20

Part of subcall function 004D6BA0: GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
Part of subcall function 004D6BA0: 6D7C7CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50

std::_Throw_Cpp_error.LIBCPMT ref: 004D6B84
std::_Throw_Cpp_error.LIBCPMT ref: 004D6B95

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyErrorFileLast
String ID:
API String ID: 1723067277-0
Opcode ID: 11b4a0396a972c246044828ff9232c2c340543bbb575df0b1910f0ee348e8719
Instruction ID: af59b977606615079acd7a310a8afa41bd250120d803ccb4a837ad8b48953fd5
Opcode Fuzzy Hash: 11b4a0396a972c246044828ff9232c2c340543bbb575df0b1910f0ee348e8719
Instruction Fuzzy Hash: 5BD18BB0C00249DBDB04DFA9C9557EEBBB1BF54304F14419ED80577382EB785A45CBA6

Function 0044B9D0 Relevance: 4.5, APIs: 3, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,0043D2B1,?), ref: 0044B9D8
GetLastError.KERNEL32(?,0043D2B1,?), ref: 0044B9E2
__dosmaperr.LIBCMT ref: 0044B9E9

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: f2de21c809301a92c9af270f6a0d9b299ea33e9ee836554a714f56a71f06c523
Instruction ID: 29a5b21677c8caf908dcad016bfb5ae84cbfd6cad116b975ceede8be2d8f2443
Opcode Fuzzy Hash: f2de21c809301a92c9af270f6a0d9b299ea33e9ee836554a714f56a71f06c523
Instruction Fuzzy Hash: 00D0C9321146086BEA106BB6BC089163B6D9A913797140616F52CC52A0EE25C895A665

Function 004C7EF0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8.46.123.33, xrefs: 004C7F78

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 8.46.123.33
API String ID: 0-2289477214
Opcode ID: 78568ed3c46049f99870abff71a8a0af4428d9f19c2022d6b1a423dafea535bf
Instruction ID: 65307ecbef6fb9e01e3d4ad067897c34c173f6a72c2a6aa1ef5fcaa49911cde8
Opcode Fuzzy Hash: 78568ed3c46049f99870abff71a8a0af4428d9f19c2022d6b1a423dafea535bf
Instruction Fuzzy Hash: 0E02A070D04248DFDB14DF68C945BDDBBB0AB14308F14419ED8057B386EBB95E88DB9A

Function 00449789 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00448E9F: GetConsoleOutputCP.KERNEL32(DCECFDFE,00000000,00000000,?), ref: 00448F02

WriteFile.KERNELBASE(?,00000000,0043D547,?,00000000,00000000,00000000,?,00000000,?,00432B5E,0043D547,00000000,00432B5E,?,?), ref: 0044990E
GetLastError.KERNEL32(?,0043D547,00000000,?,00432B5E,?,00000000,00000000), ref: 00449918

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 2beaef352ff8862ad6b8b16251cd0bd229135013537871e9a6efb1225fc67aec
Instruction ID: 4c198159cf300fc4e9085a349e24ad4d45033eb13303bb4f9288eddf9455663d
Opcode Fuzzy Hash: 2beaef352ff8862ad6b8b16251cd0bd229135013537871e9a6efb1225fc67aec
Instruction Fuzzy Hash: 9961C5B1C14119BFEF11DFA8C844AAFBBB9AF49304F14014AE800A7316D739DD05EB65

Function 004D65F0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D676A
std::_Throw_Cpp_error.LIBCPMT ref: 004D677B

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: c3335601a286ff14ab24843b336300d125ec5bb5c0d0c190e445c5a424deb578
Instruction ID: 177bb7d1701b8dda1f5a90c4ee3be826f8175b366ab48e47effb054e9b4aa952
Opcode Fuzzy Hash: c3335601a286ff14ab24843b336300d125ec5bb5c0d0c190e445c5a424deb578
Instruction Fuzzy Hash: 6441F2B1E002058BC720DF68995136EBBA1BB94314F19072FE815673D1EB79EA04C795

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E5F

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: 1fe827fdfe079599b9b1dab25e2b646f0beb01ea40d46a72429d261cc15a62e7
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00579E30,00432B5E,00000002,00432B5E,00000000,?,?,?,00442626,00000000,?,00432B5E,00000002,00579E30), ref: 00442558
GetLastError.KERNEL32(00432B5E,?,?,?,00442626,00000000,?,00432B5E,00000002,00579E30,00000000,00432B5E,00000000,00579E30,0000000C,0043D61E), ref: 00442565

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 0df1753fdbe4f7a704092f8361e7cfb0c7cc0fcadc70f8748e4d2d33b1623b65
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 0044B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00441CAE,00000001,?,?,00434B65,00000000,?,0046AB17,18EC83FF,?,00403522,?,?), ref: 0044B030
GetLastError.KERNEL32(00000000,?,00441CAE,00000001,?,?,00434B65,00000000,?,0046AB17,18EC83FF,?,00403522,?,?), ref: 0044B03B

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c4e9b2b04b0a897153f19679bc75b8cfe8e1d75e6b310813c54f5389fc1414e
Instruction ID: f233056e1464041c82b2d36bf1c88bdb576215b3e64377b8de55bab97aefa9e3
Opcode Fuzzy Hash: 1c4e9b2b04b0a897153f19679bc75b8cfe8e1d75e6b310813c54f5389fc1414e
Instruction Fuzzy Hash: 66E08C32100204ABEB212FA5AC0CB9A3B69EF00756F15802AF608971B0DB38C894D798

Function 00423800 Relevance: 1.7, APIs: 1, Instructions: 174COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004239F6

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2dba059dac2344147ab23dc7ec51248a0e8c85eac08d8f155e3ce09378acd2e4
Instruction ID: ae0d64c3ee62d8e2c2672323fae3dbdcf3c597174b0ef38ce080d0ce73c77a4b
Opcode Fuzzy Hash: 2dba059dac2344147ab23dc7ec51248a0e8c85eac08d8f155e3ce09378acd2e4
Instruction Fuzzy Hash: 7E51D671B001149FCB04EF68DD82A6EBBB5AB48304F54462EF801EB3D1DB78AA44CB95

Function 00438E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604db14e0144287d266912850847b33f66d011360b7442347f2fca8d2ff93654
Instruction ID: 9663080612542d3e5f9b84a36c3ecf1ef98ea00319430370267f097460dfd66c
Opcode Fuzzy Hash: 604db14e0144287d266912850847b33f66d011360b7442347f2fca8d2ff93654
Instruction Fuzzy Hash: 2651C670A00204AFDF14DF59C881AAABBA2EF8D328F24915EF8089B352D775DD41CB55

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044B094 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 0044B0C6

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b7e36a13cebc6b94fc046e7096c459fccaa7ac3397201fdc4f87793c7ed3808e
Instruction ID: 07eaf642519ac51a5bd3283dd2addbb445c80e248ae9cef49388ffb333b33e8c
Opcode Fuzzy Hash: b7e36a13cebc6b94fc046e7096c459fccaa7ac3397201fdc4f87793c7ed3808e
Instruction Fuzzy Hash: 99E022322006206BFF313AA69C14B5B764CEF413A3F190227EC25A62D1DB3CCC0092EE

Non-executed Functions

Function 004E6770 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 350COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8
CreateDirectoryA.KERNEL32(?,00000000), ref: 004E6C55
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C84
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C95

Strings

\*.*, xrefs: 004E6834

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectory
String ID: \*.*
API String ID: 2715195259-1173974218
Opcode ID: 9ffcfe6f386bd44e4457b7549f93ccb94d1878c7bcdfd22b0aebf5f6654fecd0
Instruction ID: b2be1bc9108cd25bcd87be18baf4e69fd7455a47ff8891d9a14199d40660ba90
Opcode Fuzzy Hash: 9ffcfe6f386bd44e4457b7549f93ccb94d1878c7bcdfd22b0aebf5f6654fecd0
Instruction Fuzzy Hash: 7AE10470C00388DFDB10DFA9C9487EEBBB0FF25315F20425AE454AB292D7746A49DB65

Function 004CF280 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 004CF2F1
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004CF30D
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004CF342
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004CF36B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000), ref: 004CF50F
WriteProcessMemory.KERNEL32(?,00000218,004CF5E0,-00000010,00000000), ref: 004CF531
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 004CF544
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004CF54D

Strings

%s|%s, xrefs: 004CF4EF
131, xrefs: 004CF4D3, 004CF4E3

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$131
API String ID: 2137838514-1629954864
Opcode ID: ce5de6916eb82fb2c3e2b46286935f90e1821b5ebdf5ce2d493db38828e4aca6
Instruction ID: 2ab717f03d3c912496b66fb944616d360f792c6fe5d042a247d22025e7d5b78f
Opcode Fuzzy Hash: ce5de6916eb82fb2c3e2b46286935f90e1821b5ebdf5ce2d493db38828e4aca6
Instruction Fuzzy Hash: 36B16BB1D002089FDB14CFA4CC95BAEBBB5FF18300F10426DE905BB291D774A984DBA5

Function 004963B0 Relevance: 17.5, APIs: 5, Strings: 4, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00496504
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00496602
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 004967F5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498078
lstrlen.KERNEL32(?), ref: 0049854F

Strings

cannot use push_back() with , xrefs: 0049840C, 0049860E
cannot use operator[] with a string argument with , xrefs: 004985BE, 00498670
Tz}9, xrefs: 00497260
;Yb., xrefs: 004974E8

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: ;Yb.$Tz}9$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-4100205650
Opcode ID: 83d1c3ab1b6e3db52684e05b2f36f2496c3e8480c2a973d5a971f7f2431674d0
Instruction ID: 6b3be8cf9a559e92d133cc3b6572ed682d4dab2050fd03768d9c929fe5be15d2
Opcode Fuzzy Hash: 83d1c3ab1b6e3db52684e05b2f36f2496c3e8480c2a973d5a971f7f2431674d0
Instruction Fuzzy Hash: 352300B0D052688BDB25CF28C9947EDBBB5BF49304F1082EAE449A7281DB746BC4CF55

Function 004986B0 Relevance: 16.1, APIs: 4, Strings: 4, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00498804
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00498902
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00498AF8
lstrlen.KERNEL32(?), ref: 0049AE11

Strings

cannot use push_back() with , xrefs: 0049AD31, 0049AEBA
cannot use operator[] with a string argument with , xrefs: 0049AE83, 0049AF19
AN|5, xrefs: 00499560
;Yb., xrefs: 0049968E

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$AN|5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-1903585501
Opcode ID: 3da693805c04dce9bee472caddb77135d006d4dcd2ef7d97c51c55debd035886
Instruction ID: e112265f5291f7fbed9e5ebb381307dd27655726dfd0f1f0b2bb5fda635101ca
Opcode Fuzzy Hash: 3da693805c04dce9bee472caddb77135d006d4dcd2ef7d97c51c55debd035886
Instruction Fuzzy Hash: D44322B0D052688BDB25CF28C8947EEBBB5BF49304F1082EAD449A7242DB756BC4CF55

Function 00432022 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?,771AE010,?), ref: 004320BA
GetLastError.KERNEL32 ref: 004320C4
FindFirstFileW.KERNEL32(?,?), ref: 004320DB
GetLastError.KERNEL32 ref: 004320E6
FindClose.KERNEL32(00000000), ref: 004320F2
___std_fs_open_handle@16.LIBCPMT ref: 004321AB

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 399e9fa649e6a34084e5cc74f8c51f104b45a1f2b4104aba3408bb700d2d57cc
Instruction ID: 7e0e21ba57e1066c6160095fdf5a0f96b949db91fc8e8bea8e80148e62c7c079
Opcode Fuzzy Hash: 399e9fa649e6a34084e5cc74f8c51f104b45a1f2b4104aba3408bb700d2d57cc
Instruction Fuzzy Hash: D971D275A007199FCB24CF28CE84BABB3B8BF09310F145296E954E3390D7B49E85CB95

Function 004E77E0 Relevance: 12.0, APIs: 5, Strings: 1, Instructions: 1467processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004E7942
Process32First.KERNEL32(00000000,?), ref: 004E7952
Process32Next.KERNEL32(00000000,?), ref: 004E796F
Process32Next.KERNEL32(00000000,?), ref: 004E7C06
CloseHandle.KERNEL32(00000000), ref: 004E7C12

Strings

exists, xrefs: 004E8FB4, 004E90A8

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process32$Next$CloseCreateFirstHandleSnapshotToolhelp32
String ID: exists
API String ID: 2284531361-2996790960
Opcode ID: 2b52750ecead61fc5423a51023d5c30c361313469b31e81f1a91713908b5e493
Instruction ID: 97c7b09e85b18bfbd9d584b3fdec642588b5c84936fa195d86b40cf47ab6f1ca
Opcode Fuzzy Hash: 2b52750ecead61fc5423a51023d5c30c361313469b31e81f1a91713908b5e493
Instruction Fuzzy Hash: 24F232B0C042688BDB25CF69C994BEDBBB1BF49310F1082DED849A7391DB345A86CF55

Function 004534CF Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004535D7
IsValidCodePage.KERNEL32(?), ref: 00453615
IsValidLocale.KERNEL32(?,00000001), ref: 00453628
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00453670
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 0045368B

Strings

*V, xrefs: 00453534

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: *V
API String ID: 415426439-2897881622
Opcode ID: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction ID: 4a54d826d8e8e5dc964d84ffa3ac1e49b68ae0fe58eca9cd8e7cd24ca5604c7d
Opcode Fuzzy Hash: bb3ee8500ca9cacc625c50b97d6e48ff5c53ad3e39c4a6c01d9da358df15b7ae
Instruction Fuzzy Hash: 4E517471A00209AFDB20DFA5CC41ABF77B8AF05743F14446AED01E7252EB74DA48DB65

Function 004C6D80 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 535fileCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004C7051

Part of subcall function 00432534: __EH_prolog3.LIBCMT ref: 00432570

std::_Throw_Cpp_error.LIBCPMT ref: 004C7062

Part of subcall function 004E74C0: __fread_nolock.LIBCMT ref: 004E7609

DeleteFileA.KERNEL32(?), ref: 004C70EB

Strings

selta, xrefs: 004C7171, 004C718A
131, xrefs: 004C7135, 004C714E

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$selta
API String ID: 3880692912-3297328945
Opcode ID: 1cfe391f2a750f8d8f57f4610aeea9365e09def46e9aee0ee0e7997436c851c8
Instruction ID: 7966019704e3fd473910eda9b3190c6326d4c2da0caac65bea49cbac806563d6
Opcode Fuzzy Hash: 1cfe391f2a750f8d8f57f4610aeea9365e09def46e9aee0ee0e7997436c851c8
Instruction Fuzzy Hash: 1E32ACB4D04248CFCB04DFA8C985BAEBBB1BF58304F14419EE8056B392D779AA45CF95

Function 00452B5A Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetACP.KERNEL32(?,?,?,?,?,?,00447300,?,?,?,?,?,-00000050,?,?,?), ref: 00452C19
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00447300,?,?,?,?,?,-00000050,?,?), ref: 00452C50
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00452DB3

Strings

utf8, xrefs: 00452D22
*V, xrefs: 00452B98

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: *V$utf8
API String ID: 607553120-210452255
Opcode ID: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction ID: 742b11dcb7ff0b0bfa38c284345f0d68b4d7ce619a9ba0daefdf44cafbbca61f
Opcode Fuzzy Hash: 95727e6ef7b94787d777f99e21165c393144e5509e4be2ad3f52f8295ffa9360
Instruction Fuzzy Hash: F071FA32600602A6D725AF75CD45B6B73A8EF16705F10042FFD05D7283EBF8E94C9699

Function 004532F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,00453605,?,?), ref: 0045338C
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,00453605,?,?), ref: 004533B5
GetACP.KERNEL32(?,?,00453605,?,?), ref: 004533CA

Strings

ACP, xrefs: 00453311
OCP, xrefs: 00453347

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction ID: 0023b8279c9b3e3643c8ce07df61025d6c2b7e12d2ffc4f7461f6cfcb2a1a3ae
Opcode Fuzzy Hash: b900ca414d4c4be95a8c6f041d08249478f894891a183a2f82a4edaf5765dc51
Instruction Fuzzy Hash: 8021C432600100A7DB308F54C900A9BB3A6AF50FD3B568466EC06D7312EF36EF49D358

Function 004E9A70 Relevance: 7.7, APIs: 5, Instructions: 181memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,771AE010,?), ref: 004E9BEE
GetProcAddress.KERNEL32(00000000,?), ref: 004E9BF9
GetProcessHeap.KERNEL32 ref: 004E9C04
RtlAllocateHeap.NTDLL(00000000,00000000,00010000), ref: 004E9C1E
RtlAllocateHeap.NTDLL(?,00000000,00010000), ref: 004E9C57

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Allocate$AddressHandleModuleProcProcess
String ID:
API String ID: 3330366720-0
Opcode ID: 13763fb7ed65d7034848c90db75977a8d0748b960893ffa14e62b2712247cb23
Instruction ID: d3ba1316c3404c5ffc03a5be9701c45b2826e37c75856fc641be7cc60fa5c5e8
Opcode Fuzzy Hash: 13763fb7ed65d7034848c90db75977a8d0748b960893ffa14e62b2712247cb23
Instruction Fuzzy Hash: CF81F0B5D04229ABDB14CF9AD884AAEFBB4FF48311F10856AE924B7350E7746A01CF54

Function 0043C960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction ID: 01dad5c531b3804b6668612822d9feb5b6f7af541a2af8c3bc89036eeee974e8
Opcode Fuzzy Hash: 333d4b6d5425d6f9d03797ee82114c3711da98524c03317fffdb5ec62fb2b380
Instruction Fuzzy Hash: DA023A71E002199BDF14CFA9D9C06AEFBB1FF48314F24926AE919B7380D735A9418B94

Function 004A3610 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 857COMMON

Download Yara Rule

APIs

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,18EC83FF,0046AB17,?,00431D09,?,005799D8,0046AB17,?,0046AB17,0106133C), ref: 0043525B

Concurrency::cancel_current_task.LIBCPMT ref: 004A4302

Part of subcall function 00402B50: ___std_exception_copy.LIBVCRUNTIME ref: 00402BA7

Strings

cannot use push_back() with , xrefs: 004A3E29, 004A42C0
cannot use operator[] with a string argument with , xrefs: 004A41BE, 004A4211, 004A424B

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionRaise___std_exception_copy
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3394888853-3306948993
Opcode ID: 8f53216de675892d6c656b907a8b4eaf3a4f216d5fc2d4a714e1e5bf0b6a4eda
Instruction ID: 6c1cbe624ddbfb0a3fb1f462f7f99e90fcb4139636a8997a18e518a2115dafd1
Opcode Fuzzy Hash: 8f53216de675892d6c656b907a8b4eaf3a4f216d5fc2d4a714e1e5bf0b6a4eda
Instruction Fuzzy Hash: F5927970C04258CBDB21CF68C9447DEBBB1AF59304F24829EE44967382EB786B84CF95

Function 0043361D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00433077,?,00000000,00000000,?,00433036,?,?,?,?,00432C52,?,?), ref: 00433655
GetSystemTimeAsFileTime.KERNEL32(?,DCECFDFE,?,?,00551382,000000FF,?,00433077,?,00000000,00000000,?,00433036,?,?), ref: 00433659

Strings

`-@, xrefs: 0043364F

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: `-@
API String ID: 743729956-3781167437
Opcode ID: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction ID: 3e04e591088ee8cc2650925c1d28f2227fba881fd4e87dc1a7d03300bd93dc66
Opcode Fuzzy Hash: a70e229828252f114f3dcb939b169fb3f53d7191ad82fa45b454faadf805d98c
Instruction Fuzzy Hash: 73F0A032904A54EFCB118F44DC11B59BBA8F708B21F004626EC12A3790DB34A9049F94

Function 00452F77 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452FCB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00453015
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004530DB

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 771d62436c19abd6dcce3df2e29dd49345e6d4ea3a13af81162c9b3a780b437f
Instruction ID: 48740d242bba4bd8a9c349c0ec2c6d2d1cd0f344531baebb5e7d544be35332ed
Opcode Fuzzy Hash: 771d62436c19abd6dcce3df2e29dd49345e6d4ea3a13af81162c9b3a780b437f
Instruction Fuzzy Hash: 4661C2315006079FEB249F25CC82BABB7A8EF04787F10417AED05C6686EB7CDA49CB54

Function 00438A64 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 00438B5C
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00438B66
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 00438B73

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 190c57a89f893cc3a60c21e64f5d89c3dc83bf777de16abb744d2c180980a4ce
Instruction ID: 8ec399b23226fa191ec5ef1820ea8a0bb8d05e2da4fe9e987d2f7c16b8c22cf0
Opcode Fuzzy Hash: 190c57a89f893cc3a60c21e64f5d89c3dc83bf777de16abb744d2c180980a4ce
Instruction Fuzzy Hash: 8331D4759013189BCB21DF65D8897CDBBB8BF08310F5051EAF81CA7251EB749B858F48

Function 00431F9C Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,0041D027,?,?,00000000,00424721), ref: 00431FA8
FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,0041D027,?,?,00000000,00424721), ref: 00431FD7
GetLastError.KERNEL32(?,0041D027,?,?,00000000,00424721), ref: 00431FE9

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: b16ae3ed5c4ea8c825a7741cabbb9deee3b3ed014939fe7a26025e30d09a83a3
Instruction ID: 374c7283d1fee54890fd1da0f93e4c1b7d6ed331c4205a5270736a92a01d96fc
Opcode Fuzzy Hash: b16ae3ed5c4ea8c825a7741cabbb9deee3b3ed014939fe7a26025e30d09a83a3
Instruction Fuzzy Hash: D9F08232000208BFDB206FB5DC08DBA7BADEB18371F108626FD68C16B0D731D9A596B5

Function 004A4320 Relevance: 3.6, Strings: 2, Instructions: 1124COMMON

Download Yara Rule

Strings

cannot use push_back() with , xrefs: 004A53EC
cannot use operator[] with a string argument with , xrefs: 004A5441, 004A5496, 004A54EB, 004A5540, 004A559A

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 0-3306948993
Opcode ID: 72d5261657c7658768fe5faedfc2c35b4241755d3c66d4b5e806afb36eedee21
Instruction ID: 8821a8bfd1e48b799a2abfd01eecbd4ab6b0e4478dc98b90df7da55720a0e0c1
Opcode Fuzzy Hash: 72d5261657c7658768fe5faedfc2c35b4241755d3c66d4b5e806afb36eedee21
Instruction Fuzzy Hash: 37C26770D042688BDB21DF68C9847EEBBB0BF69304F1481DAD44967282EB785E85CF95

Function 0044B734 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?,?,?,00447E76,?,20001004,?,00000002,?,?,00447468), ref: 0044B768

Strings

`-@, xrefs: 0044B753

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID: `-@
API String ID: 2299586839-3781167437
Opcode ID: 49b4b54da173fcca6da5c5c7afb6aecc463d0371a21e889a3031e465fe0a4c2b
Instruction ID: 6cde8863e94abc83afdff9d02dc43b85bf30edba8fd47250f688fa8aae92868b
Opcode Fuzzy Hash: 49b4b54da173fcca6da5c5c7afb6aecc463d0371a21e889a3031e465fe0a4c2b
Instruction Fuzzy Hash: 65E04F36500218BBEF223F61EC05EAE7F26EF447A2F008416FD0565271CB75C921BAE9

Function 00546D20 Relevance: 3.5, APIs: 2, Instructions: 465COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005470C3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00547121

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 704cbafd83cb264c74fc3d14c4ddb0be6021144597e852803927d713c5b9569e
Instruction ID: ee470a65dbc593a795070072979824b2ac82643cc29d3266eaeb19038688183b
Opcode Fuzzy Hash: 704cbafd83cb264c74fc3d14c4ddb0be6021144597e852803927d713c5b9569e
Instruction Fuzzy Hash: 9B02D475E0465A8BCB18CF6DD8943FDFFF1BF9A318F1542AAE859AB281D73049448B40

Function 00458E30 Relevance: 3.0, Strings: 2, Instructions: 463COMMON

Download Yara Rule

Strings

/, xrefs: 00459368
+, xrefs: 00459363

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: +$/
API String ID: 0-2439032044
Opcode ID: dd95fb86a40a875793c4cbbc2990c09bff94f118c65fea2c5132c9262adc59a0
Instruction ID: 806c9ae79926dcaf8cececc9d71f70d18bc6a9957051dde4d486c1f800b17d24
Opcode Fuzzy Hash: dd95fb86a40a875793c4cbbc2990c09bff94f118c65fea2c5132c9262adc59a0
Instruction Fuzzy Hash: A602D171900245DFCB05CF68C4946EEBBF5BF49310F24426AE865A7382D7389E49CBA5

Function 00534D40 Relevance: 2.0, Strings: 1, Instructions: 710COMMON

Download Yara Rule

Strings

%s-mj%08X, xrefs: 00534F98

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: %s-mj%08X
API String ID: 0-77246884
Opcode ID: 8640a528e6cf7eea0fde200176c328cb614cdc5be86cb0c0014a19372e8a067b
Instruction ID: 5d18eec4070a212f04a33d48acd2be0269bb50243265832a54b6b75d81467ec3
Opcode Fuzzy Hash: 8640a528e6cf7eea0fde200176c328cb614cdc5be86cb0c0014a19372e8a067b
Instruction Fuzzy Hash: CC42CEB4A006069FDB14CFA8D884BAEBBF5FF88304F149469E81AA7311E735ED45CB50

Function 004531CA Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045321E

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 4ab9832fe99221dde9f501d391a089cb7a2462732883aa12bf08d4854e9c0ffe
Instruction ID: c68ba993faf54d01c6f16d81f3f5077507b086e8cfab0080940638b83f1b5490
Opcode Fuzzy Hash: 4ab9832fe99221dde9f501d391a089cb7a2462732883aa12bf08d4854e9c0ffe
Instruction Fuzzy Hash: 8D219872514606ABDB189E25DC42A7BB3A8EF04756F1000BFFD01D6242EB7CDE489758

Function 00452E51 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

EnumSystemLocalesW.KERNEL32(00452F77,00000001,00000000,?,?,?,004535AB,?), ref: 00452EC3

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ed3a15461aa07a0672f4d58e186f542e4a9ded439744096cd7c499f36c17fdd7
Instruction ID: 0b970845e1a8773270f0425e193d970e9e25a52c90aa89fa5165c8154eb0a54b
Opcode Fuzzy Hash: ed3a15461aa07a0672f4d58e186f542e4a9ded439744096cd7c499f36c17fdd7
Instruction Fuzzy Hash: 8B11593B2007014FDB189F39D99267BB7A1FF84319B14442EED8687B41D3B5B806DB44

Function 004533F9 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00453274,00000000,00000000,?), ref: 00453425

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9fb8eb4d6cfb5dc9ab71851ad247751131481363ade4371d576ad0b9e7960359
Instruction ID: 7310505bafe8fff12ee8f5912ce4e44c5146d6de948bcf0b33cac505e4352342
Opcode Fuzzy Hash: 9fb8eb4d6cfb5dc9ab71851ad247751131481363ade4371d576ad0b9e7960359
Instruction Fuzzy Hash: 72014E336002127BDB195E25CC45BBB7764DB41797F14442AEC06A3281DA78FE45D994

Function 00452D5F Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00452DB3

Strings

utf8, xrefs: 00452D22
*V, xrefs: 00452B98

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: *V$utf8
API String ID: 3736152602-210452255
Opcode ID: 59e00f747d9bc6cf307ab543fe27e9585fa5185e009a5a777542dc83f29e6ce8
Instruction ID: aeef1e48df53c0e1e1989da3d76282249285fc4edbaa792ed956cb55b8cc0ce8
Opcode Fuzzy Hash: 59e00f747d9bc6cf307ab543fe27e9585fa5185e009a5a777542dc83f29e6ce8
Instruction Fuzzy Hash: E3F0C832610205ABD714AF35DC4AEBB73A8DB59316F10017FF902D7282EA7CAD099768

Function 00452EEC Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

EnumSystemLocalesW.KERNEL32(004531CA,00000001,?,?,?,?,00453573,?,?,?,?), ref: 00452F36

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a7aabdafeecc33135d5ef59119c1dd02303f614df75aa08249f401847eac2aa8
Instruction ID: 46f5077cb0f7882f4a3a694ed1b059b17750918d15d6876221f24d4c3ab0ea03
Opcode Fuzzy Hash: a7aabdafeecc33135d5ef59119c1dd02303f614df75aa08249f401847eac2aa8
Instruction Fuzzy Hash: 38F022372003045FDB249F35AC81A7B7BA1FB82769B15842FFE068B692C2B59C02A654

Function 0044B1B1 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044424B: RtlEnterCriticalSection.NTDLL(-00588967), ref: 0044425A

EnumSystemLocalesW.KERNEL32(0044B1A4,00000001,0057A298,0000000C,0044B5D9,?,?,?,?), ref: 0044B1E9

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: c95449866fe5fa4667aabee73304f47e4942a34859e8fff04667a9b00fb14092
Instruction ID: e80e171ad64c81d089edaf6c836f83e2cf4dda05f2f2c126e8d7e53f9a4c0b50
Opcode Fuzzy Hash: c95449866fe5fa4667aabee73304f47e4942a34859e8fff04667a9b00fb14092
Instruction Fuzzy Hash: F3F04F76A00200DFE700DF99E806B9C7BF0FB59B25F10819BF810E7290DBB999049F45

Function 00452E06 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00449E42: GetLastError.KERNEL32(00000000,?,0044F82B), ref: 00449E46
Part of subcall function 00449E42: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 00449EE8

EnumSystemLocalesW.KERNEL32(00452D5F,00000001,?,?,?,004535CD,?,?,?,?), ref: 00452E3D

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5ffb0c9d813d6eba6d8fd2e10c847f2c312efa30acac4b18343fb8da06ef6d7e
Instruction ID: fee7300587f55c0c421301d99721cdf1a1ff6f595eefe83fa7d5e966eb6188b0
Opcode Fuzzy Hash: 5ffb0c9d813d6eba6d8fd2e10c847f2c312efa30acac4b18343fb8da06ef6d7e
Instruction Fuzzy Hash: 8FF0553A30020557CB04AF35D80666BBFA0EFC2711B06405BEE09CB392C2B99846DB94

Function 004EEC40 Relevance: .8, Instructions: 763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction ID: 9b29181f1e73fb818f8d5afe29d750a692cb89b7e5c93380094c3e3283dda0cb
Opcode Fuzzy Hash: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction Fuzzy Hash: 383273B3F5161447DF1CCA6ECC922EDB2E36FD821871E813DE80AE3345EA79E9454684

Function 004F2FD0 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4a0174d0d62f2b1227807bd6e07e9c018e82f5f56551d9681256b3b92353b2
Instruction ID: 68aa0d5ee95f80c7a91d8174e86b503e14c67071ff11744bcabbed3cfa87bcc2
Opcode Fuzzy Hash: 4b4a0174d0d62f2b1227807bd6e07e9c018e82f5f56551d9681256b3b92353b2
Instruction Fuzzy Hash: F96270B0D002599FDB14CF59C5846BEBBB1BF84308F2481AEDA14AB346C779DA46CF94

Function 00547760 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fbac4b70a9c3c67ada46d8963e84295cc0882089f898ae31994d500bf3d20ec
Instruction ID: 2807212ea96b117041c7bec1f3afc05bff6e45bf6fd572f3e89de87d1ee8a68d
Opcode Fuzzy Hash: 9fbac4b70a9c3c67ada46d8963e84295cc0882089f898ae31994d500bf3d20ec
Instruction Fuzzy Hash: C7F16D7290D69A8FDB158E38C4813EDBF62FF69304F1C4AA6C4A597383D3389A45C791

Function 0042F580 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b9970b4e61b3a89387c81d03852b8640c12f30169ca405eadcc1892538b820
Instruction ID: 0e8ddfc969875e3dd00111f91a6503ca4c3a70c52638cfea05a5ef0fdf848abd
Opcode Fuzzy Hash: 80b9970b4e61b3a89387c81d03852b8640c12f30169ca405eadcc1892538b820
Instruction Fuzzy Hash: 1EE10276F1022A9FDB05CFA8D4816ADFBF1AF88320B5942AAD814B7340D774A945CB94

Function 0044036F Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41b321b0bedac8989d8c8297ce8e3211a7e70ffbcb0090baa5e3f65be106bda
Instruction ID: 86fdf0966577921a64d033a0687854855d7760d31b02c963075edfb0c817f6d8
Opcode Fuzzy Hash: a41b321b0bedac8989d8c8297ce8e3211a7e70ffbcb0090baa5e3f65be106bda
Instruction Fuzzy Hash: 45C1DA709006069FEB24CF68C484A6BBBB1EF45304F14461FDB969B791C338ED66CB5A

Function 00452610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 337bf9b0213a408d992dbd779b211f999c4c3a8d278f465cc99103b402b18e84
Instruction ID: 7c06e8313ae742015ce167e0291709e23a9c2e608a4b019449313ff3a09dc83f
Opcode Fuzzy Hash: 337bf9b0213a408d992dbd779b211f999c4c3a8d278f465cc99103b402b18e84
Instruction Fuzzy Hash: 21B129315007019BDB38EB65CD82AB7B3A8EF45309F14452FED43C6642EBB9E989C718

Function 00545DE0 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af51445418b551fcf1678b85b0f98f1f354c0bd79bc812c4d64e5654522ea52e
Instruction ID: 58693602e5fae249548aecd5a5cda3cf3ec8d10b115813b1b7ba796d0def4e87
Opcode Fuzzy Hash: af51445418b551fcf1678b85b0f98f1f354c0bd79bc812c4d64e5654522ea52e
Instruction Fuzzy Hash: 9EA14AB1A016069FDB14CF69C4846AAFBE5FF85318B28C1AAD818CB301E731ED11CB81

Function 00458BB0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab0755b21c077cf839bf9405ed2cf93180bce573716b191f7f6d9c196173859
Instruction ID: f297913e25a3591813c030fa515b242fba5e7fe6b87ce0d9dc90972f2508a2cf
Opcode Fuzzy Hash: cab0755b21c077cf839bf9405ed2cf93180bce573716b191f7f6d9c196173859
Instruction Fuzzy Hash: 0281FDB4A002469FDB118F69D8817BEFBF4AB2A315F04016EDC55A7383CB38990DD7A4

Function 004EFC40 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9e1b96ebeb8905ce8cf41e2ed65b6f129fd888b54bee42289f6865976a0455
Instruction ID: 9260139a4ef8e20400bb9b6c572cac56afe306f3fbbdb3538d7680a8b6287584
Opcode Fuzzy Hash: 5d9e1b96ebeb8905ce8cf41e2ed65b6f129fd888b54bee42289f6865976a0455
Instruction Fuzzy Hash: 506195356345684FE708CF1EECD04363B52A39E30538542AAEA81C7395C576FA2EE7E0

Function 0043A928 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction ID: 0bb0d4fe57c201db2c152aeff89cf209e4ab217caaafa113e802d716cdce1c0b
Opcode Fuzzy Hash: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction Fuzzy Hash: 5B517D72D00219AFDF04CF99C940AEFBBB6FF88314F198459E955AB301D7389A50CB95

Function 004371A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4ba24db855cab2182e42f47a77fd888252c09f86d43135b4b8e5651c7dd79236
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: B21131F724D08143EA74863DC8B46BBA795EBCD320F2D63BBE0C14BB58D52AD5459908

Function 004E90C0 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 423libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,771AE010,?), ref: 004E92A0
GetProcAddress.KERNEL32(00000000,?), ref: 004E92B0
GetModuleHandleA.KERNEL32(?), ref: 004E93C8
GetProcAddress.KERNEL32(00000000,?), ref: 004E93D2
OpenProcess.KERNEL32(00000040,00000000,?), ref: 004E93DE
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000), ref: 004E944D
CloseHandle.KERNEL32(?), ref: 004E9480
CloseHandle.KERNEL32(?), ref: 004E94A6
CloseHandle.KERNEL32(00000000), ref: 004E94C6
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 004E9668
ResetEvent.KERNEL32(00000000), ref: 004E9671
CreateThread.KERNEL32(00000000,00000000,004E97A0,?,00000000,00000000), ref: 004E9695
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 004E96A1
RtlUnicodeStringToAnsiString.NTDLL(?,?,00000001), ref: 004E96E7
CloseHandle.KERNEL32(?), ref: 004E9728
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000001), ref: 004E9734
CloseHandle.KERNEL32(?), ref: 004E9753
TerminateThread.KERNEL32(?,00000000), ref: 004E9781

Strings

File, xrefs: 004E94F0

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Handle$Close$Process$AddressCreateCurrentEventModuleProcStringThread$AnsiObjectOpenResetSingleTerminateUnicodeWait
String ID: File
API String ID: 3681783469-749574446
Opcode ID: 02c975d743a992077f3dbef84ff0a07a20ddd4842273eff2ca5adffffcfc23b6
Instruction ID: b9b0c17e31d3cfe0bbc2e9151a178c1e78e3251af3666c5291f23336d4f8ce8a
Opcode Fuzzy Hash: 02c975d743a992077f3dbef84ff0a07a20ddd4842273eff2ca5adffffcfc23b6
Instruction Fuzzy Hash: 6322D2B4D042599FDB24CF99D981BEEBBB4BF08310F104199E909B7390E7746A81CFA5

Function 0041A060 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0041A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A0E7
__Getctype.LIBCPMT ref: 0041A1C5
std::_Facet_Register.LIBCPMT ref: 0041A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A223

Strings

E@, xrefs: 0041A1AE
PD@, xrefs: 0041A19A
PG@, xrefs: 0041A1BF

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: PD@$PG@$E@
API String ID: 1102183713-4120405683
Opcode ID: 9c2fb5f23b8a6ef50c0a87551a20d9a1a173f7e45579ddf469c0ebb2b07afed2
Instruction ID: b372b58ab1bb25eec4b44a09b7f8f3aef2cc67a410616163416d5e42c3dffe19
Opcode Fuzzy Hash: 9c2fb5f23b8a6ef50c0a87551a20d9a1a173f7e45579ddf469c0ebb2b07afed2
Instruction Fuzzy Hash: 6E51BAB0D01245DFCB11CF98C9457AEBBF0FB14714F14825ED855AB391DB78AA88CB92

Function 004372D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00437307
___except_validate_context_record.LIBVCRUNTIME ref: 0043730F
_ValidateLocalCookies.LIBCMT ref: 00437398
__IsNonwritableInCurrentImage.LIBCMT ref: 004373C3
_ValidateLocalCookies.LIBCMT ref: 00437418

Strings

`-@, xrefs: 004373DC
csm, xrefs: 004373AD

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: `-@$csm
API String ID: 1170836740-3738301566
Opcode ID: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction ID: bde692452db8eba3752ab90a3e7788ac0719a0bf92b2230e47b89eff8dfd02fd
Opcode Fuzzy Hash: a837c65dc98bc53f7a591b5dada66322cfdf011b0ab20b220170fbbfaeea83fd
Instruction Fuzzy Hash: B041F8709042099FCF20DF59C885A9FBBA4BF08328F14905BFC54AB392D739E905DB95

Function 0041C430 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0041C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C4A4
std::_Facet_Register.LIBCPMT ref: 0041C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0041C5C4

Strings

E@, xrefs: 0041C562
PD@, xrefs: 0041C54E

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: E@$PD@
API String ID: 459529453-4103272508
Opcode ID: 5d5041aa5d60d0880ebdc6a58bad771eee35cf9a11b34294d639c79e11cc1adc
Instruction ID: e4bc83ced0ac359faa997fd18d4eeb760fe14de2594101695cc0fd15b6690fbc
Opcode Fuzzy Hash: 5d5041aa5d60d0880ebdc6a58bad771eee35cf9a11b34294d639c79e11cc1adc
Instruction Fuzzy Hash: C351EFB0900255EFDB11CF58C991BAEBBF0FB10314F24415EE846AB381D7B9AA45CB95

Function 0044B37E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0044B48D,?,?,00000000,00000016,?,?,0044B6B7,00000022,FlsSetValue,00561B88,00561B90,00000016), ref: 0044B43F

Strings

ext-ms-, xrefs: 0044B3E9
api-ms-, xrefs: 0044B3D5

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction ID: e3d7dbf8d3e43151f67a2d3675c4fcd7809fc0c9af6198dcb17880ded4e1cd5b
Opcode Fuzzy Hash: 033630484f002e070c94113c7b6ef7f262f68e90d70309fdd043a749aa00ed93
Instruction Fuzzy Hash: A2212B36A01220A7E7319F619C45A6B7768EB51761F140112FC06A7392D734ED05D6D9

Function 00443633 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,DCECFDFE,?,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 00443668
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044367A
FreeLibrary.KERNEL32(00000000,?,00000000,00551365,000000FF,?,0044360F,?,?,004435E3,00000016), ref: 0044369C

Strings

`-@, xrefs: 0044368B
mscoree.dll, xrefs: 00443661
CorExitProcess, xrefs: 00443672

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$`-@$mscoree.dll
API String ID: 4061214504-3731901874
Opcode ID: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction ID: 11f561727bfec435161e86ab51d2faaed74d5e09c0b89d0474703e999051cdf2
Opcode Fuzzy Hash: 66c557226bdf84cfe892202a4e2d9d598a1facfa92736b92f61228ad13b2a6bb
Instruction Fuzzy Hash: 5601A232A44715AFDB219F44DC19BAFBBB8FB14B52F014526E812E27E0DB749A04CA94

Function 004D6BA0 Relevance: 9.2, APIs: 6, Instructions: 164fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
6D7C7CF0.RSTRTMGR(?,00000000,?), ref: 004D6C50
SetLastError.KERNEL32(00000000), ref: 004D6CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D25
GetLastError.KERNEL32(?,?,00000000), ref: 004D6D33
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D47

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$CopyFile
String ID:
API String ID: 936320341-0
Opcode ID: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction ID: cca443e56f4e81c83c2dc89493b37bcb85ee1d7da0cfa031959f485395bd6110
Opcode Fuzzy Hash: 2f0097d69676047ed723569c17c067a4a1f2d969b86affe3f6592f517df160a8
Instruction Fuzzy Hash: 6051C172D01219ABCB21CF94DC55BEEBBB8EB04320F10026AE804B3390D7396E05CBA4

Function 00432729 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00432730
std::_Lockit::_Lockit.LIBCPMT ref: 0043273B
std::_Lockit::~_Lockit.LIBCPMT ref: 004327A9

Part of subcall function 0043288C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004328A4

std::locale::_Setgloballocale.LIBCPMT ref: 00432756

Strings

`-@, xrefs: 00432778, 0043279C

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID: `-@
API String ID: 677527491-3781167437
Opcode ID: 37577bf2a80403a51899406bddbde92f65c249edf66a066c41dee1567bca50bf
Instruction ID: 335728d06f8999c9367bb6f0cb93ad347570f0e44e9dcbef2930aaa8ccdcd417
Opcode Fuzzy Hash: 37577bf2a80403a51899406bddbde92f65c249edf66a066c41dee1567bca50bf
Instruction Fuzzy Hash: 9D01FC35A006109BC70AFB20CC5157D7BB0FF98790F44250EE81163391CFB8AE06DB89

Function 00432BC8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00432BDC
RtlAcquireSRWLockExclusive.NTDLL(?), ref: 00432BFB
RtlAcquireSRWLockExclusive.NTDLL(?), ref: 00432C29
RtlTryAcquireSRWLockExclusive.NTDLL(?), ref: 00432C84
RtlTryAcquireSRWLockExclusive.NTDLL(?), ref: 00432C9B

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction ID: ee0d2db44a198d3d02c1eb3b1b0ff5a364ec90963e300245c4d31640e9e12550
Opcode Fuzzy Hash: 8f089e7040faa662b45679f060ee1b8a0f0adfff173fd46cb89089840a213128
Instruction Fuzzy Hash: B2415931900A0ADFCB20DF65CA8096EB3B4FF0C311F20692BD446D7650D7B8E986DB69

Function 00406180 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 353COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00406587

Strings

: ", xrefs: 004063AE
", ", xrefs: 004063D8
)@, xrefs: 00406581

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$", "$: "
API String ID: 4194217158-2520320562
Opcode ID: c1c11d7fb1cd80d3ff13af8c623d0fecf0494c18f99482b571f58a5e7d9cf1ae
Instruction ID: 193815703dc37f45cda184aa0d75e7307a57ae547af4f9c577389d6cf834964f
Opcode Fuzzy Hash: c1c11d7fb1cd80d3ff13af8c623d0fecf0494c18f99482b571f58a5e7d9cf1ae
Instruction Fuzzy Hash: 85D1E370D00205DFCB14DFA8C945AAEBBF5FF44304F10462EE456A7381DB78AA55CB99

Function 00407350 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0040750C
___std_exception_destroy.LIBVCRUNTIME ref: 00407522

Strings

[json.exception., xrefs: 004073A1
)@, xrefs: 00407502, 0040751C

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$[json.exception.
API String ID: 4194217158-3378332251
Opcode ID: e4330e840f4c54607f5232ae7e228b7ade3f40d7aa291d92d50d17836804149a
Instruction ID: d1fd1ad00dbeab1566b73d8112c34bc80c76f551163e59ed82d928a5322bc1a2
Opcode Fuzzy Hash: e4330e840f4c54607f5232ae7e228b7ade3f40d7aa291d92d50d17836804149a
Instruction Fuzzy Hash: 8C51CFB1C046489BD710DFA8C905B9EBBB4FF15318F14426EE850A73C2E7B86A44C7A5

Function 00404900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,18EC83FF,0046AB17,?,00431D09,?,005799D8,0046AB17,?,0046AB17,0106133C), ref: 0043525B

Strings

ios_base::eofbit set, xrefs: 00404946
ios_base::badbit set, xrefs: 00404937, 00404962
ios_base::failbit set, xrefs: 00404828, 00404941

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction ID: 99c94d1e80f512c720ba00148ae48faeb0acee82eabb402b7e5943aa58dcc262
Opcode Fuzzy Hash: 5e8fcf04681b5496c91e096f1d273a5343178b8940b0c322b64de4dd1df32f3c
Instruction Fuzzy Hash: AC119CF2844644ABCB10DF688C03BAB37C8E744715F04463EFE58972C1EB399800C79A

Function 00448E9F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(DCECFDFE,00000000,00000000,?), ref: 00448F02

Part of subcall function 0044EC55: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0044A862,?,00000000,-00000008), ref: 0044ECB6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00449154
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0044919A
GetLastError.KERNEL32 ref: 0044923D

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 91d99b140007bd56c2f11d9a0fac077867534d6b54893de6431ff092d3abe5dd
Instruction ID: b6f9ea87837ca93654473fd2bae4ec290e60b55bc3ade45d2d9d29a5185f0d60
Opcode Fuzzy Hash: 91d99b140007bd56c2f11d9a0fac077867534d6b54893de6431ff092d3abe5dd
Instruction Fuzzy Hash: 70D1BC75D00249AFDF14CFA8C880AAEBBB5FF09304F28456AE856EB351D734AD45CB54

Function 004E97A0 Relevance: 6.2, APIs: 4, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 004E98CE
GetProcAddress.KERNEL32(00000000,?), ref: 004E98DA
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 004E9A55
SetEvent.KERNEL32(00000000), ref: 004E9A5C

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Event$AddressCreateHandleModuleProc
String ID:
API String ID: 2341598627-0
Opcode ID: 2850c510e0873b556520308870891a000327a13676cc7a4ce2949c56bcf108ea
Instruction ID: 94e94f94aa147367d366308f7bbda68d1ba073eefd2343970e9372381d670d86
Opcode Fuzzy Hash: 2850c510e0873b556520308870891a000327a13676cc7a4ce2949c56bcf108ea
Instruction Fuzzy Hash: 88819AB490C3829FC304CF59C48195AFBE5AFA8390F10891EF89587361E775D989CF96

Function 00431F0C Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000400,?,?,?,?,00000000,00000000,?,?,?,0041A856,00000000,?,?,00000000), ref: 00431F29
GetLastError.KERNEL32(?,0041A856,00000000,?,?,00000000,00000000,?,?), ref: 00431F35
WideCharToMultiByte.KERNEL32(?,00000000,?,?,?,?,00000000,00000000,?,0041A856,00000000,?,?,00000000,00000000,?), ref: 00431F5B
GetLastError.KERNEL32(?,0041A856,00000000,?,?,00000000,00000000,?,?), ref: 00431F67

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 35e7bea43bf35a340b569ac256c958a5570a5f93565d5de543f4fdf7da8372b1
Instruction ID: 5e8341cea1a57eda6e9d4b8ca3b7a39c6f892c49641055c0ca5066718be154a8
Opcode Fuzzy Hash: 35e7bea43bf35a340b569ac256c958a5570a5f93565d5de543f4fdf7da8372b1
Instruction Fuzzy Hash: C901FF36600255BBCF221FA1DC08D9B3E36EBD97A1F104015FE1556230C7318866E7B5

Function 00456D32 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,0043D547,00000000,00000000,?,00453DCE,00000000,00000001,?,?,?,00449291,?,00000000,00000000), ref: 00456D49
GetLastError.KERNEL32(?,00453DCE,00000000,00000001,?,?,?,00449291,?,00000000,00000000,?,?,?,0044986B,00000000), ref: 00456D55

Part of subcall function 00456D1B: CloseHandle.KERNEL32(FFFFFFFE,00456D65,?,00453DCE,00000000,00000001,?,?,?,00449291,?,00000000,00000000,?,?), ref: 00456D2B

___initconout.LIBCMT ref: 00456D65

Part of subcall function 00456CDD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00456D0C,00453DBB,?,?,00449291,?,00000000,00000000,?), ref: 00456CF0

WriteConsoleW.KERNEL32(00000000,00000000,0043D547,00000000,?,00453DCE,00000000,00000001,?,?,?,00449291,?,00000000,00000000,?), ref: 00456D7A

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction ID: b582005f90f2c4d159ccd48a3422ceca8e6e351b7b3b67145bbef734a6de3f3c
Opcode Fuzzy Hash: 6d252f6c85546040703605b5d122fbb434f3c9b6b34be8e7cd3f73b3df330617
Instruction Fuzzy Hash: F4F01C37500518BBCF221FD1DC18A8A3F76EB583A2B814415FE0D96231D6328928EB94

Function 00408F20 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 272libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 004091C8
GetProcAddress.KERNEL32(00000000,?), ref: 004091D3

Strings

Ws2_32.dll, xrefs: 004091BF

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Ws2_32.dll
API String ID: 1646373207-3093949381
Opcode ID: 4029716d11f6571ef0759e38241cbf9d70b68e10af6bbd003f6e88ce5b02a30e
Instruction ID: cb5ead6240095672237fdab8273f91d80b82b8d73d4ae51f565ea22395c8577a
Opcode Fuzzy Hash: 4029716d11f6571ef0759e38241cbf9d70b68e10af6bbd003f6e88ce5b02a30e
Instruction Fuzzy Hash: E7C16A70E01214DFCB24CFA8C84579EBBB0BF08714F24859EE955AB392D779AD01CB95

Function 004036E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403819
___std_exception_destroy.LIBVCRUNTIME ref: 004038F0

Strings

)@, xrefs: 004037ED, 004038EA

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: )@
API String ID: 2970364248-4120265097
Opcode ID: 81d5d02e461f4f166f6459a7f61821ba362e836743d5e8eb3d1cfbc247b2b74e
Instruction ID: 269ef50febfdc4b1c22cf7239a576f40f0b19685bcb009e1facc48eb6157c32a
Opcode Fuzzy Hash: 81d5d02e461f4f166f6459a7f61821ba362e836743d5e8eb3d1cfbc247b2b74e
Instruction Fuzzy Hash: DD6169B1C00248DBDB10DF98C945B9EFFB5FF19324F14825EE814AB282D7B95A44CBA5

Function 00407B10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00407CAC
___std_exception_destroy.LIBVCRUNTIME ref: 00407CC2

Strings

)@, xrefs: 00407CA2, 00407CBC

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@
API String ID: 4194217158-4120265097
Opcode ID: 7f39d47836504a7423aab65aa40483168d682e35b864809af48f52d19c8c8e2a
Instruction ID: 2d5fa3d367423be86db8b91485125f203ee18fb15550ca5d49c40f7a3d1822d9
Opcode Fuzzy Hash: 7f39d47836504a7423aab65aa40483168d682e35b864809af48f52d19c8c8e2a
Instruction Fuzzy Hash: 0051D3B1C052489BDB00DF98D9457DEFBF4EF19318F10426EE814A7381E7B96A44C7A5

Function 004047F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040499F

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,18EC83FF,0046AB17,?,00431D09,?,005799D8,0046AB17,?,0046AB17,0106133C), ref: 0043525B

Strings

ios_base::badbit set, xrefs: 00404937, 00404962
ios_base::failbit set, xrefs: 00404828

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: fed3493b01e8557903b528af4f88663475c45d25b4347422020baa5cab059aa8
Instruction ID: 59789774a96eacd1a5b8f49c51d8e497543063f0a2ed12b155596828dbf76f3a
Opcode Fuzzy Hash: fed3493b01e8557903b528af4f88663475c45d25b4347422020baa5cab059aa8
Instruction Fuzzy Hash: E84124B2C00244ABCB04DF68C845BAEBBB8FB49710F14826EF554A73C1D7795A00CBA5

Function 00404040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004040C4

Strings

bad locale name, xrefs: 004040E6

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 4f86f9a361d865152f401e3e2a632dcf866a544c369ba022f9cf666f0f7b581e
Instruction ID: 65c2995a4cce64452fc0e082f9126f7f9302ed92d60cad1113ce5137d9e79936
Opcode Fuzzy Hash: 4f86f9a361d865152f401e3e2a632dcf866a544c369ba022f9cf666f0f7b581e
Instruction Fuzzy Hash: DB112670805B84EED321CF69C50474BBFF0AF25714F10868DD09597781D3B9A604CB95

Function 00416590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004165C9
___std_exception_copy.LIBVCRUNTIME ref: 004165FC

Strings

)@, xrefs: 004165BA, 004165ED

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_copy
String ID: )@
API String ID: 2659868963-4120265097
Opcode ID: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction ID: 79ebb971947c26e29da123751e765caa72f3f100f47198c89106861aa63fe252
Opcode Fuzzy Hash: ec459901e9a8c12f2536e06f4ce64afd8286d8aca2aa337d2d7da09c98386d96
Instruction Fuzzy Hash: F0112EB6910649EBCB11CF99C980B86FBF8FF09724F10876AE82497641E774A5448BA0

Function 00407A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00407A5C
___std_exception_destroy.LIBVCRUNTIME ref: 00407A72

Strings

)@, xrefs: 00407A52, 00407A6C

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@
API String ID: 4194217158-4120265097
Opcode ID: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction ID: 96290d15a7b89a27e7413382239de33ac52fdad5c525fa7f0e86a9c1871ea130
Opcode Fuzzy Hash: 9ee8fa866bcea9d2c14fc14309fcadf8facde4318e0e6bb098ed358a1a235593
Instruction Fuzzy Hash: 68F012B1805744DFC711DF98C90178DFFF8FB05728F50466AE855A3780E7B5660487A5

Function 0044B7F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000016,00000001,004389D2,00000001,00000016,00438BE1,?,?,?,?,?,00000000), ref: 0044B834

Strings

`-@, xrefs: 0044B824
InitializeCriticalSectionEx, xrefs: 0044B804

Memory Dump Source

Source File: 00000000.00000002.1406765755.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1406717830.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406862853.000000000055D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406892270.0000000000585000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406907800.000000000058A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406927004.0000000000596000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000598000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.0000000000771000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1406941275.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1408216672.0000000000980000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$`-@
API String ID: 2593887523-3269949891
Opcode ID: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction ID: 5bcc12c1b0658f8dc7434a33690804c70bb56e7eadbb0958c8ec10a8e9d05d13
Opcode Fuzzy Hash: 1f2253b5c78e33ee57fe7f30907939316c5faef6f9275bf3e632fad4f43c2f0e
Instruction Fuzzy Hash: BDE09236581318BBCB212F92DC06DAE7F25EB24BA2F048022FD1956161C7768821BBD9

Analysis Process: MPGPH131.exePID: 3308, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	23.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	43

Executed Functions

Function 004AA200 Relevance: 56.8, APIs: 10, Strings: 11, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 004AA277

Part of subcall function 004C6000: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F

Strings

;Yb., xrefs: 004BCCC8
Jzv", xrefs: 004BCB48
cannot use operator[] with a string argument with , xrefs: 004B14F5, 004B152D, 004B1580, 004B15B5, 004B15EC, 004B34C2, 004B3500, 004B35B5, 004B83F4, 004B848D, 004BDF6D, 004BE0D4, 004BE129, 004BE17E, 004BE1D9, 004BE22E, 004BE283, 004BE2D8, 004BE32D, 004BE382, 004BFF65, 004BFFA3, 004C0058, 004C1DEA, 004C1E28, 004C1EDD, 004C5EE8, 004C5F20, 004C5FB2
X<b., xrefs: 004B0396
;Yb., xrefs: 004B26EA
cannot use push_back() with , xrefs: 004B10BB, 004B1333, 004B3367, 004B3558, 004B8296, 004B842E, 004BDFC9, 004BE020, 004BE074, 004BFE23, 004BFFFB, 004C1CD9, 004C1E80, 004C5F5A
;Yb., xrefs: 004BAF18
WUa5, xrefs: 004BAC90
;Yb., xrefs: 004C47B2
;Yb., xrefs: 004B04F0
;Yb., xrefs: 004B62DD

Memory Dump Source

Source File: 0000000E.00000002.1648079157.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1648062263.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648284086.0000000000585000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648306775.000000000058A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648328888.0000000000596000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000598000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000771000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.00000000007B0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648645366.0000000000980000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MPGPH131.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$Jzv"$WUa5$X<b.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-383699475
Opcode ID: a3e0360778d83ddd9abda925fda10ee934784615eebea6291e1a1d3c0b8b4fbf
Instruction ID: d5c29c46e18a526762dbfc7c8aed9f945ae13eab665394adbd88e65e82b678fb
Opcode Fuzzy Hash: a3e0360778d83ddd9abda925fda10ee934784615eebea6291e1a1d3c0b8b4fbf
Instruction Fuzzy Hash: 29B433B0D052698BDB25CF68C984BEEBBB1BF49304F1081DAD449A7281DB746F84CF95

Function 0049F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0049F224
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049F322
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049F515
CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1C76

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1F5D
lstrlen.KERNEL32(?), ref: 004A348E

Strings

cannot use operator[] with a string argument with , xrefs: 004A3571, 004A35C6
;Yb., xrefs: 0049FC4C
cannot use push_back() with , xrefs: 004A3518
~]d, xrefs: 0049FAC6

Memory Dump Source

Source File: 0000000E.00000002.1648079157.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1648062263.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648284086.0000000000585000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648306775.000000000058A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648328888.0000000000596000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000598000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000771000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.00000000007B0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648645366.0000000000980000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MPGPH131.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $~]d
API String ID: 2833034228-1763774129
Opcode ID: 66ff86b6ee86fd584d77de4af8526b9e7e9d316f957d28481444bdbe466824e0
Instruction ID: 3f98b5ef17dcfaa8f689e4fcb5a5d7fbbd5e2711f2842c60bb6495c93d0a2e70
Opcode Fuzzy Hash: 66ff86b6ee86fd584d77de4af8526b9e7e9d316f957d28481444bdbe466824e0
Instruction Fuzzy Hash: 2793DCB4D052A98ADB65CF29C990BEDBBB1BF59304F0081EAD84DA7241DB742BC4CF45

Function 004DF030 Relevance: 8.4, APIs: 5, Instructions: 876
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004DF09A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF329

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF52A
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DF84A

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DFC7D

Part of subcall function 004E6770: FindFirstFileA.KERNELBASE(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

Memory Dump Source

Source File: 0000000E.00000002.1648079157.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1648062263.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648284086.0000000000585000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648306775.000000000058A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648328888.0000000000596000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000598000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000771000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.00000000007B0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648645366.0000000000980000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MPGPH131.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID:
API String ID: 2127212259-0
Opcode ID: 0a9d66dacc852727762dd02661486b9ec628ab0a78a4986b9bfafa3a96ef7e23
Instruction ID: 8e27dc709fe3b7ff7b62f4d1f71842afe3ac2492894b6e8ccfd466f18f63ab33
Opcode Fuzzy Hash: 0a9d66dacc852727762dd02661486b9ec628ab0a78a4986b9bfafa3a96ef7e23
Instruction Fuzzy Hash: DBA202B4D0425D8BDF25CFA8C995AEEBBB0BF18304F2041AAD949B7351D7341A84CFA5

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 004C613F
FindNextFileA.KERNELBASE(00000000,00000010), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 0000000E.00000002.1648079157.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1648062263.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648284086.0000000000585000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648306775.000000000058A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648328888.0000000000596000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000598000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000771000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.00000000007B0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648645366.0000000000980000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MPGPH131.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: 90cf4eca11af66bb089fdb4a1b4223e767fc84b405f6936ed3c5d03910aaf901
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: 90cf4eca11af66bb089fdb4a1b4223e767fc84b405f6936ed3c5d03910aaf901
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 0045E140 Relevance: 21.9, APIs: 11, Strings: 1, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 0040BA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045E3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045E4C6
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0045E808
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045E986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045EB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045EC10

Part of subcall function 004E6CA0: GetFileAttributesA.KERNELBASE(?,?,?,00460404), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00460404), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045ED06

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045EDED
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045F06D

Strings

p!, xrefs: 0045E208, 0045E952

Memory Dump Source

Source File: 0000000E.00000002.1648079157.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1648062263.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648284086.0000000000585000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648306775.000000000058A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648328888.0000000000596000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000598000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000771000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.00000000007B0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648645366.0000000000980000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MPGPH131.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID: p!
API String ID: 453214671-1397568850
Opcode ID: e1ed7e54ebd5b020c8e79904b3ae03e0818e29e9e47e40a3245b38651c09fec3
Instruction ID: 0e418cf523baa0a35c0a910b93c4bb77d5942d6061cfe1063ad62b245a56bb8b
Opcode Fuzzy Hash: e1ed7e54ebd5b020c8e79904b3ae03e0818e29e9e47e40a3245b38651c09fec3
Instruction Fuzzy Hash: 4FA226B0D012688BCB25DB65CD95BDDBBB4AF14304F0040EED44A67282EB785F88DF5A

Function 0044B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B030
GetLastError.KERNEL32(?,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B03B

Memory Dump Source

Source File: 0000000E.00000002.1648079157.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1648062263.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648256336.000000000055D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648284086.0000000000585000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648306775.000000000058A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648328888.0000000000596000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000598000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.0000000000771000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648352111.00000000007B0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000E.00000002.1648645366.0000000000980000.00000020.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction ID: f233056e1464041c82b2d36bf1c88bdb576215b3e64377b8de55bab97aefa9e3
Opcode Fuzzy Hash: 99a1dad4488ae4134b0b86126f226bb7eaf0feb81a688c838a9a99aa0a8ec9ba
Instruction Fuzzy Hash: 66E08C32100204ABEB212FA5AC0CB9A3B69EF00756F15802AF608971B0DB38C894D798

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_cf4e7bfd48f2a6b37dc7526592834c22e9a43fc_f4fd270f_a89dfd47-cc32-4b15-9bfd-9524009e54c9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBC0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD16E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1AD.tmp.xml

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\EfSAyduNP94O7VkIcUcjXr_.zip

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

C:\Users\user\AppData\Local\Temp\spanAK6XIXNsn5Nq\D87fZN3R3jFeplaces.sqlite

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\02zdBXl47cvzcookies.sqlite

C:\Users\user\AppData\Local\Temp\spanTk4mNNg5wnH2\08X6GAad3tnjCookies

Windows Analysis Report
file.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre