Edit tour

Windows Analysis Report
dendy.exe

Overview

General Information

Sample name:	dendy.exe
Analysis ID:	1427876
MD5:	446f080cd1ed262b4dd0c1ff2143297e
SHA1:	b958c52622a02d7ed530f6d41a7e7c24a27f7918
SHA256:	a211901dea69eab959b9e47a6276ba7f363b6857687c410adcaf56135586b7ea
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to check for running processes (XOR)

Contains functionality to inject threads in other processes

Country aware sample found (crashes after keyboard check)

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

dendy.exe (PID: 7028 cmdline: "C:\Users\user\Desktop\dendy.exe" MD5: 446F080CD1ED262B4DD0C1FF2143297E)

schtasks.exe (PID: 7144 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3428 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 2520 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 868 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4924 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 952 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4476 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4020 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4308 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3004 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 1464 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6420 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 1472 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 6688 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 446F080CD1ED262B4DD0C1FF2143297E)

WerFault.exe (PID: 7164 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 804 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2520 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 928 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4040 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 964 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 6996 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 446F080CD1ED262B4DD0C1FF2143297E)

WerFault.exe (PID: 5664 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 780 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6252 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 892 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6212 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 924 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3864 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 884 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 5164 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 446F080CD1ED262B4DD0C1FF2143297E)

WerFault.exe (PID: 4884 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 820 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\c9bTQaLpRNBVsUoe4pkuQMW.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\6XWWeAeVicQTZ7HrJgfaAa9.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7SoGIg_Dgh61RYTHw6zemBp.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000002.2495191919.000000000305E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000002.2495000425.0000000002DAA000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.2495191919.000000000312B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2343911888.00000000077F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2343201454.0000000002F6D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2502097335.000000000799A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2508449882.0000000002E39000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.2415760901.0000000007999000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2415493241.0000000007995000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2501230299.000000000300C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: dendy.exe PID: 7028	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: dendy.exe PID: 7028	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6688	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6996	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6996	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 5164	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 5164	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.dendy.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
8.2.MPGPH131.exe.4a60e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
26.2.RageMP131.exe.4a40e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.2.dendy.exe.4a80e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
26.2.RageMP131.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.3.MPGPH131.exe.4bc0000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
8.3.MPGPH131.exe.4bb0000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
26.3.RageMP131.exe.4b90000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.2.dendy.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.2.MPGPH131.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
8.2.MPGPH131.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
26.2.RageMP131.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.2.MPGPH131.exe.4a70e67.1.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0.3.dendy.exe.4bd0000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
8.2.MPGPH131.exe.400000.0.raw.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
9.2.MPGPH131.exe.400000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\dendy.exe, ProcessId: 7028, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-09:41:54.899031
SID:	2046269
Source Port:	49731
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:16.817956
SID:	2046267
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:09.663282
SID:	2046266
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-09:41:53.335082
SID:	2046269
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-09:42:13.250995
SID:	2046269
Source Port:	49746
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-09:41:09.471690
SID:	2049060
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-09:42:02.523877
SID:	2046269
Source Port:	49739
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:13.824615
SID:	2046266
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:13.499765
SID:	2046266
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:43.723664
SID:	2046267
Source Port:	58709
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:19.788174
SID:	2046267
Source Port:	58709
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:19.803148
SID:	2046267
Source Port:	58709
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:29.078780
SID:	2046266
Source Port:	58709
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/18/24-09:41:54.901092
SID:	2046269
Source Port:	49732
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:36.448653
SID:	2046266
Source Port:	58709
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-09:41:43.865022
SID:	2046267
Source Port:	58709
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: dendy.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://193.233.132.167/cost/lenin.exe

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Avira: detection malicious, Label: TR/AVI.AceCrypter.tzrgz

Multi AV Scanner detection for domain / URL

Source: http://147.45.47.102:57893/hera/amadka.exe	Virustotal: Detection: 15%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exe68.0	Virustotal: Detection: 15%	Perma Link
Source: http://193.233.132.167/cost/go.exe	Virustotal: Detection: 24%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 82%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 71%	Perma Link

Multi AV Scanner detection for submitted file

Source: dendy.exe	ReversingLabs: Detection: 82%
Source: dendy.exe	Virustotal: Detection: 71%			Perma Link

Machine Learning detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: dendy.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0041F3EB CryptUnprotectData,LocalFree,		0_2_0041F3EB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041F3EB CryptUnprotectData,LocalFree,		8_2_0041F3EB

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\dendy.exe	Unpacked PE file: 0.2.dendy.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 8.2.MPGPH131.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 26.2.RageMP131.exe.400000.0.unpack

Source: dendy.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\dendy.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49750 version: TLS 1.2

Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	0_2_0040E7B0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	0_2_004DB1CB
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0040B300 GetDateFormatW,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_0040B300
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_0041FA10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	8_2_0040E7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	8_2_004DB1CB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040B300 GetDateFormatW,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	8_2_0040B300
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	8_2_0041FA10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043EAEB FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	8_2_0043EAEB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DB251 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	8_2_004DB251
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043FBB9 FindFirstFileA,FindNextFileA,GetLastError,FindClose,CreateFileA,GetFileSize,ReadFile,CloseHandle,	8_2_0043FBB9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_04B3B4B8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	8_2_04B3B4B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_04B3B432 FindClose,FindFirstFileExW,GetLastError,	8_2_04B3B432

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_b25a0167-156e-47da-8b75-d9e08c1e0ac7\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_4f7c52ae-a147-40d8-a3f2-8a9bebe00511\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49731 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49739
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49739 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49746
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49746 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49739
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49746

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.93 147.45.47.93
Source: Joe Sandbox View	IP Address: 104.26.5.15 104.26.5.15

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_0041E220 recv,setsockopt,recv,WSAGetLastError,recv,recv,setsockopt,recv,recv,recv,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,Sleep,Sleep,

0_2_0041E220

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe2
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe6
Source: RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe68.0
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeCH
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeadka.ex
Source: MPGPH131.exe, 00000008.00000002.2510972800.0000000007967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exedka.exeuKRx
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exehoin5
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exeisepro_botj
Source: RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: dendy.exe, 00000000.00000002.2501929485.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe.exe/HS2
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe192.168.0gA
Source: RageMP131.exe, 0000001A.00000002.2496030568.0000000007967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe_tenant_idr
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exeania)
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exenesCH
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: dendy.exe, dendy.exe, 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, dendy.exe, 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: dendy.exe, 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, dendy.exe, 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDpRTpR
Source: dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MPGPH131.exe, 00000009.00000003.2119466041.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/GIG
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/ZMru
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81
Source: RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52A
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52dress
Source: RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/~
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2119466041.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52
Source: RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52s
Source: dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/4
Source: RageMP131.exe, 0000001A.00000002.2495191919.000000000308F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/8
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2119466041.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/X
Source: dendy.exe, 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, dendy.exe, 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EB0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
Source: RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52F
Source: dendy.exe, 00000000.00000002.2500536171.0000000002E8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52l
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/x
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: dendy.exe, 00000000.00000003.2186305953.00000000079AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2218273477.00000000079B8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210121788.0000000007862000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253627094.0000000007986000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2255795866.0000000007985000.00000004.00000020.00020000.00000000.sdmp, xLkPmPbriQeYHistory.26.dr, hn0rI1Di9iTsHistory.0.dr, GrE_iBTQJdDJHistory.26.dr, fNgu77Rnk80sHistory.9.dr, 7QP8D56XEcyNHistory.9.dr, 9kIPQpaY4rvVHistory.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: xLkPmPbriQeYHistory.26.dr, hn0rI1Di9iTsHistory.0.dr, GrE_iBTQJdDJHistory.26.dr, fNgu77Rnk80sHistory.9.dr, 7QP8D56XEcyNHistory.9.dr, 9kIPQpaY4rvVHistory.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: dendy.exe, 00000000.00000003.2186305953.00000000079AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2218273477.00000000079B8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210121788.0000000007862000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253627094.0000000007986000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2255795866.0000000007985000.00000004.00000020.00020000.00000000.sdmp, xLkPmPbriQeYHistory.26.dr, hn0rI1Di9iTsHistory.0.dr, GrE_iBTQJdDJHistory.26.dr, fNgu77Rnk80sHistory.9.dr, 7QP8D56XEcyNHistory.9.dr, 9kIPQpaY4rvVHistory.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: xLkPmPbriQeYHistory.26.dr, hn0rI1Di9iTsHistory.0.dr, GrE_iBTQJdDJHistory.26.dr, fNgu77Rnk80sHistory.9.dr, 7QP8D56XEcyNHistory.9.dr, 9kIPQpaY4rvVHistory.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: dendy.exe, 00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2502097335.000000000799A000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415760901.0000000007999000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007995000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2500536171.0000000002E3E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343911888.00000000077F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.000000000305E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp, c9bTQaLpRNBVsUoe4pkuQMW.zip.26.dr, 6XWWeAeVicQTZ7HrJgfaAa9.zip.0.dr, 7SoGIg_Dgh61RYTHw6zemBp.zip.9.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: dendy.exe, 00000000.00000002.2502097335.000000000799A000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415760901.0000000007999000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT117.0.2045.47
Source: RageMP131.exe, 0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTIva
Source: RageMP131.exe, 0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTOU~
Source: dendy.exe, 00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTV
Source: RageMP131.exe, 0000001A.00000002.2495191919.000000000305E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTn
Source: MPGPH131.exe, 00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343911888.00000000077F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTq
Source: RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.000000000312B000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.9.dr, passwords.txt.0.dr, passwords.txt.26.dr	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot1.181.57.52
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botDA
Source: RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlateraQ
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2119466041.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botomania
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrA
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bottl;
Source: dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: dendy.exe, MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510972800.0000000007967000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2496030568.0000000007967000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: dendy.exe, 00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343911888.000000000782A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207118365.000000000782A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210034289.000000000782A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210806911.000000000782A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2496030568.000000000795F000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.26.dr, 3b6N2Xdh3CYwplaces.sqlite.9.dr, 3b6N2Xdh3CYwplaces.sqlite.26.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/f
Source: D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: dendy.exe, 00000000.00000002.2501929485.0000000007968000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2496030568.0000000007967000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ATCH
Source: RageMP131.exe, 0000001A.00000002.2496030568.0000000007967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/e.dat
Source: dendy.exe, 00000000.00000002.2501929485.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/esktop
Source: dendy.exe, 00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343911888.000000000782A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207118365.000000000782A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210034289.000000000782A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210806911.000000000782A000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2496030568.000000000795F000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.26.dr, 3b6N2Xdh3CYwplaces.sqlite.9.dr, 3b6N2Xdh3CYwplaces.sqlite.26.dr, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.9.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ragon
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refoxo

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49750 version: TLS 1.2

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 8_2_0040BAC0 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

8_2_0040BAC0

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000001A.00000002.2495000425.0000000002DAA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2343201454.0000000002F6D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.2508449882.0000000002E39000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2501230299.000000000300C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00446020	0_2_00446020
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00428180	0_2_00428180
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00496450	0_2_00496450
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00406430	0_2_00406430
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004224D9	0_2_004224D9
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0040C490	0_2_0040C490
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045A490	0_2_0045A490
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004564A0	0_2_004564A0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0048C560	0_2_0048C560
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00458520	0_2_00458520
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00438770	0_2_00438770
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00424730	0_2_00424730
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0040E7B0	0_2_0040E7B0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0043C800	0_2_0043C800
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0044A8F0	0_2_0044A8F0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00442940	0_2_00442940
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0042C980	0_2_0042C980
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0043CA90	0_2_0043CA90
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00434B20	0_2_00434B20
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0042EB90	0_2_0042EB90
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045CC40	0_2_0045CC40
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00440C10	0_2_00440C10
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0040CD50	0_2_0040CD50
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004E925D	0_2_004E925D
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0048D250	0_2_0048D250
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004CB3C0	0_2_004CB3C0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00431430	0_2_00431430
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045B4B0	0_2_0045B4B0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0043B65D	0_2_0043B65D
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00423670	0_2_00423670
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0042B670	0_2_0042B670
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004176B0	0_2_004176B0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0043B750	0_2_0043B750
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004378A0	0_2_004378A0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00431BE0	0_2_00431BE0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045DDE5	0_2_0045DDE5
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0041FF09	0_2_0041FF09
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0040BFC0	0_2_0040BFC0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0048BFB0	0_2_0048BFB0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0048E040	0_2_0048E040
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0044C160	0_2_0044C160
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0049A160	0_2_0049A160
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00490100	0_2_00490100
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004D02E0	0_2_004D02E0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004202AA	0_2_004202AA
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0048E35B	0_2_0048E35B
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00422360	0_2_00422360
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004D4310	0_2_004D4310
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004E03D0	0_2_004E03D0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00402410	0_2_00402410
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004944E0	0_2_004944E0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00416490	0_2_00416490
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00402600	0_2_00402600
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00484620	0_2_00484620
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00422852	0_2_00422852
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00490860	0_2_00490860
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00446020	8_2_00446020
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00428180	8_2_00428180
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00496450	8_2_00496450
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00406430	8_2_00406430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004224D9	8_2_004224D9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040C490	8_2_0040C490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045A490	8_2_0045A490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004564A0	8_2_004564A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048C560	8_2_0048C560
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00458520	8_2_00458520
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00438770	8_2_00438770
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00424730	8_2_00424730
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040E7B0	8_2_0040E7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043C800	8_2_0043C800
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0044A8F0	8_2_0044A8F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00442940	8_2_00442940
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0042C980	8_2_0042C980
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043CA90	8_2_0043CA90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00434B20	8_2_00434B20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0042EB90	8_2_0042EB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045CC40	8_2_0045CC40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00440C10	8_2_00440C10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040CD50	8_2_0040CD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004E925D	8_2_004E925D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048D250	8_2_0048D250
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004CB3C0	8_2_004CB3C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00431430	8_2_00431430
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045B4B0	8_2_0045B4B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043B65D	8_2_0043B65D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00423670	8_2_00423670
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0042B670	8_2_0042B670
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004176B0	8_2_004176B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043B750	8_2_0043B750
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004B5870	8_2_004B5870
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004378A0	8_2_004378A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00431BE0	8_2_00431BE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041FF09	8_2_0041FF09
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040BFC0	8_2_0040BFC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048BFB0	8_2_0048BFB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048E040	8_2_0048E040
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0044C160	8_2_0044C160
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0049A160	8_2_0049A160
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00490100	8_2_00490100
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004D02E0	8_2_004D02E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004202AA	8_2_004202AA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048E35B	8_2_0048E35B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00422360	8_2_00422360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004D4310	8_2_004D4310
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004E03D0	8_2_004E03D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00402410	8_2_00402410
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004944E0	8_2_004944E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00416490	8_2_00416490
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00402600	8_2_00402600
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00484620	8_2_00484620
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00422852	8_2_00422852
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00490860	8_2_00490860
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043EAEB	8_2_0043EAEB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004D2A90	8_2_004D2A90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00486AA0	8_2_00486AA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004D0B30	8_2_004D0B30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0044EB90	8_2_0044EB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004F6CC5	8_2_004F6CC5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048ECA2	8_2_0048ECA2
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048CD80	8_2_0048CD80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00490E40	8_2_00490E40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0049EE70	8_2_0049EE70
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0049AE20	8_2_0049AE20
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00418EE0	8_2_00418EE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00482FE0	8_2_00482FE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00440FF5	8_2_00440FF5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048D020	8_2_0048D020
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004CD080	8_2_004CD080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00487270	8_2_00487270
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0047F360	8_2_0047F360
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00483470	8_2_00483470
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048B4F0	8_2_0048B4F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004E959F	8_2_004E959F
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004A36EE	8_2_004A36EE
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00433740	8_2_00433740
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00489720	8_2_00489720
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004497D0	8_2_004497D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048F7B0	8_2_0048F7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00401900	8_2_00401900
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004BB9E0	8_2_004BB9E0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004FD9FE	8_2_004FD9FE
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004099A0	8_2_004099A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00481A30	8_2_00481A30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004E3B58	8_2_004E3B58
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004E5B90	8_2_004E5B90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0048BC00	8_2_0048BC00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00409D90	8_2_00409D90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004D1E50	8_2_004D1E50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00483EF0	8_2_00483EF0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043FF40	8_2_0043FF40
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043FF13	8_2_0043FF13
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00485FD0	8_2_00485FD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00493FF0	8_2_00493FF0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_04B494C4	8_2_04B494C4

Source: C:\Users\user\Desktop\dendy.exe	Code function: String function: 0048FE50 appears 35 times
Source: C:\Users\user\Desktop\dendy.exe	Code function: String function: 00469F00 appears 46 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 004DD5B0 appears 54 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0048FE50 appears 91 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00469F00 appears 58 times

Source: C:\Users\user\Desktop\dendy.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 868

Source: dendy.exe	Binary or memory string: OriginalFilename vs dendy.exe
Source: dendy.exe, 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs dendy.exe
Source: dendy.exe, 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs dendy.exe
Source: dendy.exe, 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefilezilla.exe4 vs dendy.exe

Source: dendy.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0000001A.00000002.2495000425.0000000002DAA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2343201454.0000000002F6D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.2508449882.0000000002E39000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2501230299.000000000300C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/129@2/3

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_00492300 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

0_2_00492300

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_00491D10 CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

0_2_00491D10

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_0040CD50 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

0_2_0040CD50

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_00446020 CopyFileA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,CopyFileA,GetUserNameA,CopyFileA,SHGetFolderPathA,CoInitialize,CoCreateInstance,MultiByteToWideChar,CoUninitialize,ShellExecuteA,

0_2_00446020

Source: C:\Users\user\Desktop\dendy.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3748:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5164
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7028
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6688
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6996
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_03

Source: C:\Users\user\Desktop\dendy.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: dendy.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\dendy.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\dendy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: dendy.exe, dendy.exe, 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, dendy.exe, 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: dendy.exe, 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, dendy.exe, 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: MPGPH131.exe, 00000008.00000003.2219788988.0000000007992000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE autofill_sync_metadata (model_typ;
Source: MPGPH131.exe, 00000008.00000003.2217856798.00000000079AF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217789940.0000000007992000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217503233.0000000007992000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207246038.000000000782C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2206986632.000000000782C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2252440203.000000000313C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2252918330.000000000313C000.00000004.00000020.00020000.00000000.sdmp, 6xQrR_hJnX90Login Data For Account.26.dr, q4newEXeW0gGLogin Data For Account.0.dr, BYnglavidnY6Login Data.9.dr, s5KTHH5Pma1BLogin Data For Account.9.dr, nF96X0gSy0TrLogin Data.0.dr, fd7hv5c9m7PWLogin Data.26.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: dendy.exe	ReversingLabs: Detection: 82%
Source: dendy.exe	Virustotal: Detection: 71%

Source: dendy.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\dendy.exe

File read: C:\Users\user\Desktop\dendy.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\dendy.exe "C:\Users\user\Desktop\dendy.exe"
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 868
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 804
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 780
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 952
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 892
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 1464
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 924
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 964
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 884
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 1472
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 820
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\dendy.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dpapi.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\dendy.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\dendy.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\dendy.exe	Unpacked PE file: 0.2.dendy.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 8.2.MPGPH131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 26.2.RageMP131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\dendy.exe	Unpacked PE file: 0.2.dendy.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 8.2.MPGPH131.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 26.2.RageMP131.exe.400000.0.unpack

Contains functionality to check for running processes (XOR)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,

8_2_00409D90

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_0045DDE5 LoadLibraryA,GetProcAddress,MessageBoxA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,SetThreadExecutionState,

0_2_0045DDE5

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004C112B push ecx; iretd	8_2_004C112C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DD189 push ecx; ret	8_2_004DD19C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_02E3C17B push ebp; ret	8_2_02E3C181
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_02E3C536 push esp; ret	8_2_02E3C537
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_02E3DC08 push cs; ret	8_2_02E3DC09

Source: C:\Users\user\Desktop\dendy.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\dendy.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\dendy.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\dendy.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\dendy.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 8_2_00482FE0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_00482FE0

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\dendy.exe

Event Logs and Signature results: Application crash and keyboard check

Found API chain indicative of sandbox detection

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep
Source: C:\Users\user\Desktop\dendy.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep			graph_0-53224

Found evasive API chain (may stop execution after checking mutex)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Source: C:\Users\user\Desktop\dendy.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_0-50515

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\Desktop\dendy.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_0-50709

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\dendy.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-50522
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\Desktop\dendy.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,		0_2_0045D9F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,		8_2_0045D9F0

Source: C:\Users\user\Desktop\dendy.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-50641
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\dendy.exe TID: 7020	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe TID: 7020	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe TID: 7020	Thread sleep count: 78 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6780	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6780	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6780	Thread sleep count: 52 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6780	Thread sleep count: 102 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7160	Thread sleep count: 56 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7160	Thread sleep count: 54 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7160	Thread sleep count: 105 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6256	Thread sleep count: 70 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 6256	Thread sleep count: 122 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00464270 GetKeyboardLayoutList followed by cmp: cmp esi, edi and CTI: je 00464293h	0_2_00464270
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004624B0 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 004624C0h country: Upper Sorbian (hsb)	0_2_004624B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00464270 GetKeyboardLayoutList followed by cmp: cmp esi, edi and CTI: je 00464293h	8_2_00464270
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004624B0 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 004624C0h country: Upper Sorbian (hsb)	8_2_004624B0

Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00492190 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 004921D1h		0_2_00492190
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00492190 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 004921D1h		8_2_00492190

Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	0_2_0040E7B0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	0_2_004DB1CB
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0040B300 GetDateFormatW,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_0040B300
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_0041FA10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040E7B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,	8_2_0040E7B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DB1CB FindClose,FindFirstFileExW,GetLastError,	8_2_004DB1CB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0040B300 GetDateFormatW,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	8_2_0040B300
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041FA10 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	8_2_0041FA10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043EAEB FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CopyFileA,CopyFileA,	8_2_0043EAEB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DB251 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	8_2_004DB251
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043FBB9 FindFirstFileA,FindNextFileA,GetLastError,FindClose,CreateFileA,GetFileSize,ReadFile,CloseHandle,	8_2_0043FBB9
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_04B3B4B8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	8_2_04B3B4B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_04B3B432 FindClose,FindFirstFileExW,GetLastError,	8_2_04B3B432

Source: C:\Users\user\Desktop\dendy.exe

0_2_0040CD50

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_b25a0167-156e-47da-8b75-d9e08c1e0ac7\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_4f7c52ae-a147-40d8-a3f2-8a9bebe00511\

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: RageMP131.exe, 0000001A.00000002.2495191919.0000000003050000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&n
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F57000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2119466041.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030A9000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: MPGPH131.exe, 00000008.00000003.1787082883.0000000002F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MPGPH131.exe, 00000009.00000003.2307496857.0000000007848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_BFCABCAF
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 00000009.00000003.2307496857.0000000007848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}j
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: MPGPH131.exe, 00000008.00000003.2410074087.00000000079A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}d
Source: dendy.exe, 00000000.00000003.1745606759.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}p;
Source: MPGPH131.exe, 00000008.00000003.2410074087.00000000079A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}b
Source: dendy.exe, 00000000.00000002.2500536171.0000000002E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&R:
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: RageMP131.exe, 0000001A.00000002.2496030568.0000000007967000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}U
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: RageMP131.exe, 0000001A.00000002.2495191919.00000000030BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}M
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: MPGPH131.exe, 00000009.00000003.1783804935.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}b
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: RageMP131.exe, 0000001A.00000003.2392293405.0000000007981000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@:
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RageMP131.exe, 0000001A.00000003.1939608500.00000000030C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}L
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002EBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}v
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn<
Source: dendy.exe, 00000000.00000002.2500536171.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxU
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnK
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MPGPH131.exe, 00000009.00000002.2342275444.0000000002E60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&@
Source: dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@I

Source: C:\Users\user\Desktop\dendy.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\dendy.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_00414870 IsDebuggerPresent,

0_2_00414870

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_0045E5D4 CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,OutputDebugStringA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

0_2_0045E5D4

Source: C:\Users\user\Desktop\dendy.exe

0_2_0045DDE5

Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_004160B0 mov ecx, dword ptr fs:[00000030h]	0_2_004160B0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045E5D4 mov eax, dword ptr fs:[00000030h]	0_2_0045E5D4
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045E5D4 mov ecx, dword ptr fs:[00000030h]	0_2_0045E5D4
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0043CA90 mov eax, dword ptr fs:[00000030h]	0_2_0043CA90
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045EA9C mov eax, dword ptr fs:[00000030h]	0_2_0045EA9C
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	0_2_0045D9F0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	0_2_0045D9F0
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	0_2_0045DDE5
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_0041AB90 mov eax, dword ptr fs:[00000030h]	0_2_0041AB90
Source: C:\Users\user\Desktop\dendy.exe	Code function: 0_2_00414870 mov eax, dword ptr fs:[00000030h]	0_2_00414870
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045E5D4 mov eax, dword ptr fs:[00000030h]	8_2_0045E5D4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045E5D4 mov ecx, dword ptr fs:[00000030h]	8_2_0045E5D4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0043CA90 mov eax, dword ptr fs:[00000030h]	8_2_0043CA90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045EA9C mov eax, dword ptr fs:[00000030h]	8_2_0045EA9C
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	8_2_0045D9F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	8_2_0045D9F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0045DDE5 mov eax, dword ptr fs:[00000030h]	8_2_0045DDE5
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004160B0 mov ecx, dword ptr fs:[00000030h]	8_2_004160B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414870 mov eax, dword ptr fs:[00000030h]	8_2_00414870
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_00414ED0 mov eax, dword ptr fs:[00000030h]	8_2_00414ED0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041EF10 mov eax, dword ptr fs:[00000030h]	8_2_0041EF10
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_02E390A3 push dword ptr fs:[00000030h]	8_2_02E390A3

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 8_2_00482C80 GetProcessHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

8_2_00482C80

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DD3B4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_004DD3B4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004DD74D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_004DD74D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 8_2_004E1C94 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_004E1C94

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Code function: 8_2_00418BB0 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

8_2_00418BB0

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_004149F0 cpuid

0_2_004149F0

Source: C:\Users\user\Desktop\dendy.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0040CD50
Source: C:\Users\user\Desktop\dendy.exe	Code function: EnumSystemLocalesW,	0_2_004FC045
Source: C:\Users\user\Desktop\dendy.exe	Code function: EnumSystemLocalesW,	0_2_004FC090
Source: C:\Users\user\Desktop\dendy.exe	Code function: EnumSystemLocalesW,	0_2_004FC12B
Source: C:\Users\user\Desktop\dendy.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004FC1B6
Source: C:\Users\user\Desktop\dendy.exe	Code function: EnumSystemLocalesW,	0_2_004F43EA
Source: C:\Users\user\Desktop\dendy.exe	Code function: GetLocaleInfoW,	0_2_004FC409
Source: C:\Users\user\Desktop\dendy.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004FC532
Source: C:\Users\user\Desktop\dendy.exe	Code function: GetLocaleInfoW,	0_2_004FC638
Source: C:\Users\user\Desktop\dendy.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004FC70E
Source: C:\Users\user\Desktop\dendy.exe	Code function: GetLocaleInfoW,	0_2_004F496D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	8_2_0040CD50
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	8_2_004FC045
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	8_2_004FC090
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	8_2_004FC12B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_004FC1B6
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	8_2_004F43EA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	8_2_004FC409
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_004FC532
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	8_2_004FC638
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_004FC70E
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	8_2_004F496D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoEx,FormatMessageA,	8_2_004DAFC3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	8_2_004FBD99
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	8_2_004FBF9E

Source: C:\Users\user\Desktop\dendy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\dendy.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\dendy.exe

0_2_0040CD50

Source: C:\Users\user\Desktop\dendy.exe

0_2_00446020

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_004F636F GetTimeZoneInformation,

0_2_004F636F

Source: C:\Users\user\Desktop\dendy.exe

Code function: 0_2_00491C30 GetVersionExA,CreateFileW,

0_2_00491C30

Source: C:\Users\user\Desktop\dendy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 0.2.dendy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.4a60e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.4a40e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dendy.exe.4a80e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.MPGPH131.exe.4bc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.MPGPH131.exe.4bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.RageMP131.exe.4b90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dendy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.4a70e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.dendy.exe.4bd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2495191919.000000000305E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2343911888.00000000077F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2502097335.000000000799A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2415760901.0000000007999000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2415493241.0000000007995000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dendy.exe PID: 7028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 5164, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\c9bTQaLpRNBVsUoe4pkuQMW.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6XWWeAeVicQTZ7HrJgfaAa9.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7SoGIg_Dgh61RYTHw6zemBp.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: dendy.exe, 00000000.00000003.2415734936.0000000002F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets?
Source: dendy.exe, 00000000.00000003.2383566671.00000000079B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: dendy.exe, 00000000.00000003.2383566671.00000000079B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Jaxx\Local Storage
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: dendy.exe, 00000000.00000003.2415734936.0000000002F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: dendy.exe, 00000000.00000002.2500954846.0000000002F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: dendy.exe, 00000000.00000003.2415734936.0000000002F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: dendy.exe, 00000000.00000002.2500954846.0000000002F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: dendy.exe, 00000000.00000002.2500954846.0000000002F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: dendy.exe, 00000000.00000003.2415734936.0000000002F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger LiveY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\dendy.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\dendy.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2495191919.000000000312B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dendy.exe PID: 7028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 5164, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 0.2.dendy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.4a60e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.4a40e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dendy.exe.4a80e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.MPGPH131.exe.4bc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.MPGPH131.exe.4bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.RageMP131.exe.4b90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.dendy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.RageMP131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.4a70e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.dendy.exe.4bd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MPGPH131.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MPGPH131.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2495191919.000000000305E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2343911888.00000000077F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2502097335.000000000799A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2415760901.0000000007999000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2415493241.0000000007995000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dendy.exe PID: 7028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 5164, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\c9bTQaLpRNBVsUoe4pkuQMW.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\6XWWeAeVicQTZ7HrJgfaAa9.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7SoGIg_Dgh61RYTHw6zemBp.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	22 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	57 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	261 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	12 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dendy.exe	83%	ReversingLabs	Win32.Trojan.Privateloader
dendy.exe	71%	Virustotal		Browse
dendy.exe	100%	Avira	TR/AVI.AceCrypter.tzrgz
dendy.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	TR/AVI.AceCrypter.tzrgz
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	83%	ReversingLabs	Win32.Trojan.Privateloader
C:\ProgramData\MPGPH131\MPGPH131.exe	71%	Virustotal		Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	83%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	71%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://193.233.132.167/cost/lenin.exe	100%	URL Reputation	malware
http://147.45.47.102:57893/hera/amadka.exe	15%	Virustotal		Browse
http://147.45.47.102:57893/hera/amadka.exe68.0	15%	Virustotal		Browse
http://193.233.132.167/cost/go.exe	25%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.5.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/81.181.57.52	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.233.132.167/cost/lenin.exenesCH	MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	D87fZN3R3jFeplaces.sqlite.9.dr	false		high
http://193.233.132.167/cost/lenin.exe.exe/HS2	dendy.exe, 00000000.00000002.2501929485.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.47.102:57893/hera/amadka.exe6	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	false		high
https://t.me/RiseProSUPPORTq	MPGPH131.exe, 00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343911888.00000000077F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exeadka.ex	RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/RiseProSUPPORTOU~	RageMP131.exe, 0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTn	RageMP131.exe, 0000001A.00000002.2495191919.000000000305E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://db-ip.com/demo/home.php?s=81	MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe2	MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.47.102:57893/hera/amadka.exeCH	MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com/	MPGPH131.exe, 00000009.00000003.2119466041.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botrA	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe68.0	RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	false		high
https://t.me/risepro_bottl;	MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	dendy.exe, 00000000.00000003.2186305953.00000000079AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2218273477.00000000079B8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210121788.0000000007862000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253627094.0000000007986000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2255795866.0000000007985000.00000004.00000020.00020000.00000000.sdmp, xLkPmPbriQeYHistory.26.dr, hn0rI1Di9iTsHistory.0.dr, GrE_iBTQJdDJHistory.26.dr, fNgu77Rnk80sHistory.9.dr, 7QP8D56XEcyNHistory.9.dr, 9kIPQpaY4rvVHistory.0.dr	false		high
https://t.me/RiseProSUPPORT117.0.2045.47	dendy.exe, 00000000.00000002.2502097335.000000000799A000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415760901.0000000007999000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007995000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe	MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
https://ipinfo.io/x	MPGPH131.exe, 00000009.00000002.2342275444.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTV	dendy.exe, 00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exeisepro_botj	MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/risepro_botDA	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/81.181.57.52	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/ZMru	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/81.181.57.52l	dendy.exe, 00000000.00000002.2500536171.0000000002E8A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	xLkPmPbriQeYHistory.26.dr, hn0rI1Di9iTsHistory.0.dr, GrE_iBTQJdDJHistory.26.dr, fNgu77Rnk80sHistory.9.dr, 7QP8D56XEcyNHistory.9.dr, 9kIPQpaY4rvVHistory.0.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	false		high
http://193.233.132.167/cost/go.exedka.exeuKRx	MPGPH131.exe, 00000008.00000002.2510972800.0000000007967000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/cost/lenin.exe	RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://t.me/risepro_botrisepro	MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/lenin.exeania)	MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52s	RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52A	MPGPH131.exe, 00000008.00000002.2508595887.0000000002F6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com:443/demo/home.php?s=81.181.57.52	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2119466041.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/X	MPGPH131.exe, 00000008.00000002.2508595887.0000000002F7D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/81.181.57.52F	RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	false		high
http://193.233.132.167/cost/lenin.exe192.168.0gA	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com/demo/home.php?s=81.181.57.52dress	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	dendy.exe, 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, dendy.exe, 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	false		high
http://upx.sf.net	Amcache.hve.7.dr	false		high
https://t.me/RiseProSUPPORT	dendy.exe, 00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2502097335.000000000799A000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415760901.0000000007999000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415493241.0000000007995000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2500536171.0000000002E3E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F0E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343911888.00000000077F0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.000000000305E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp, c9bTQaLpRNBVsUoe4pkuQMW.zip.26.dr, 6XWWeAeVicQTZ7HrJgfaAa9.zip.0.dr, 7SoGIg_Dgh61RYTHw6zemBp.zip.9.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	dendy.exe, 00000000.00000003.2186305953.00000000079AD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2218273477.00000000079B8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210121788.0000000007862000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253627094.0000000007986000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2255795866.0000000007985000.00000004.00000020.00020000.00000000.sdmp, xLkPmPbriQeYHistory.26.dr, hn0rI1Di9iTsHistory.0.dr, GrE_iBTQJdDJHistory.26.dr, fNgu77Rnk80sHistory.9.dr, 7QP8D56XEcyNHistory.9.dr, 9kIPQpaY4rvVHistory.0.dr	false		high
https://www.ecosia.org/newtab/	dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	false		high
https://ipinfo.io/Mozilla/5.0	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2508595887.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2119466041.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.9.dr	false		high
https://db-ip.com/GIG	MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot1.181.57.52	MPGPH131.exe, 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botomania	dendy.exe, 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2119466041.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	false		high
https://ipinfo.io/8	RageMP131.exe, 0000001A.00000002.2495191919.000000000308F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot	RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2218615210.000000000312B000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.9.dr, passwords.txt.0.dr, passwords.txt.26.dr	false		high
http://193.233.132.167/cost/lenin.exe_tenant_idr	RageMP131.exe, 0000001A.00000002.2496030568.0000000007967000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com/~	RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/	RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exehoin5	MPGPH131.exe, 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.maxmind.com/en/locate-my-ip-address	dendy.exe, MPGPH131.exe	false		high
https://ipinfo.io/4	dendy.exe, 00000000.00000002.2500954846.0000000002EAE000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2415846117.0000000002EAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botlateraQ	RageMP131.exe, 0000001A.00000003.2218615210.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495191919.00000000030D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTIva	RageMP131.exe, 0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDll	dendy.exe, dendy.exe, 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, dendy.exe, 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.9.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	xLkPmPbriQeYHistory.26.dr, hn0rI1Di9iTsHistory.0.dr, GrE_iBTQJdDJHistory.26.dr, fNgu77Rnk80sHistory.9.dr, 7QP8D56XEcyNHistory.9.dr, 9kIPQpaY4rvVHistory.0.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	dendy.exe, 00000000.00000003.2190337967.00000000079D7000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2185569564.00000000079BB000.00000004.00000020.00020000.00000000.sdmp, dendy.exe, 00000000.00000003.2186887342.00000000079CE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2221361449.00000000079D9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2217856798.00000000079A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.2219324558.00000000079C9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2208409406.0000000007866000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2210859373.0000000007883000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2207337910.0000000007843000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2254070104.00000000079A8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2256092823.0000000007996000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000003.2253005024.0000000007977000.00000004.00000020.00020000.00000000.sdmp, FDWjNP4RsRAAWeb Data.9.dr, xjqD6LmmUXwRWeb Data.26.dr, jivh3ZMPe0AVWeb Data.0.dr, UilUp13UfaxJWeb Data.0.dr, o47QYaSXnflcWeb Data.9.dr, 0SUQ0f15JMK7Web Data.26.dr, wUqBSbUei7PhWeb Data.0.dr, 2l02O9W1_FhwWeb Data.9.dr, NuTl_5zQHhB1Web Data.26.dr	false		high
http://www.winimage.com/zLibDllDpRTpR	dendy.exe, 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, dendy.exe, 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, dendy.exe, 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
104.26.5.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427876
Start date and time:	2024-04-18 09:40:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dendy.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/129@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 88 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:41:08	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
08:41:08	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
09:41:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
09:41:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.93	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	I44O512o10.exe	Get hash	malicious	RisePro Stealer	Browse
	Jt0SXpowC4.exe	Get hash	malicious	RisePro Stealer	Browse
	oZ8kX4OA5q.exe	Get hash	malicious	RisePro Stealer	Browse
104.26.5.15	SecuriteInfo.com.Win64.Evo-gen.17494.7440.exe	Get hash	malicious	Unknown	Browse	api.db-ip.com/v2/free/127.0.0.1
	Nemty.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/84.17.52.2/countryName
	227.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/102.129.143.40/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	EpsilonFruit.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	BetaUnfrated.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SecuriteInfo.com.FileRepMalware.18165.2747.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.FileRepMalware.18165.2747.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
db-ip.com	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.75.166
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	34.117.186.192
	EpsilonFruit.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://www.indeks.pt/	Get hash	malicious	Unknown	Browse	34.117.198.124
	BetaUnfrated.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
FREE-NET-ASFREEnetEU	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	193.233.132.175
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	https://casestudybuddy.com	Get hash	malicious	Unknown	Browse	147.45.47.87
	PBZcC2ge1z.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	147.45.77.238
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
CLOUDFLARENETUS	5Dw2hTQmiB.exe	Get hash	malicious	LummaC	Browse	104.21.44.10
	Purchase Order PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	104.21.44.10
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	p silp AI240190.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://ortelia.com/Downloads/Curator/CuratorSetup.exe	Get hash	malicious	Havoc	Browse	1.1.1.1
	https://app.esign.docusign.com/e/er?utm_campaign=GBL_XX_DBU_NEW_2307_FreetoTrialUnlock_Email1AU&utm_medium=email&utm_source=Eloqua&elqCampaignId=29542&s=566810826&lid=32871&elqTrackId=1034fb987fd44c9a9a4d0833ff06a55d&elq=89d72859fe264966a0176d4309dbb1a6&elqaid=60251&elqat=1	Get hash	malicious	Unknown	Browse	172.64.151.101
	https://ortelia.com/download-ortelia-curator/	Get hash	malicious	Havoc	Browse	1.1.1.1
	SecuriteInfo.com.Win32.PWSX-gen.1728.1300.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	5Dw2hTQmiB.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	Quotation 20241804.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	ORDER-CONFIRMATION-DETAILS-000235374564.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	payload.js	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	payload.js	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	SecuriteInfo.com.Win32.RATX-gen.12024.12837.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.5.15 34.117.186.192
	forcedelctl.dll	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	909312
Entropy (8bit):	7.543718231589517
Encrypted:	false
SSDEEP:	12288:nrpWNztODIkpIKLFkXLWR4ICfCjDmEtx9YGk5gtB2f1pnYbn+Bnd+WDbLEa:1ZIkqKz4/fa6SId229Gb+z+2LEa
MD5:	446F080CD1ED262B4DD0C1FF2143297E
SHA1:	B958C52622A02D7ED530F6D41A7E7C24A27F7918
SHA-256:	A211901DEA69EAB959B9E47A6276BA7F363B6857687C410ADCAF56135586B7EA
SHA-512:	B176604CB47C789B42DB3119DF7480B5B25C126682CC6AD769D963B1CAB228DA0DB277C1B007365962DA89D62657EE01CD5C153FEC00D2FB1AFE312B9D6488DE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:.D.[...[...[....+..[....=..[....:..[.......[...[...[....4..[......[..../..[..Rich.[..........................PE..L...$..d............................A.............@.................................t......................................\|...(.... ......................................................H...........@............................................text...}........................... ..`.rdata..P...........................@..@.data.....~......"..................@....tls................................@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_24a29007-21d3-42b0-b4aa-a502308dbc55\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9362136584930133
Encrypted:	false
SSDEEP:	192:GpBynzw8b3056r96E6jjC+ZrVszuiFhZ24IO8oj6t9i:4wwmE56rwjezuiFhY4IO8L
MD5:	9940E079D8A4C38B46CB3121E0B4784D
SHA1:	14FD178D2BD0FFB881087F3689249364961896E0
SHA-256:	431ECF47E959F2F3FDF570C5CEB163496A35D78780C3E3AE9DC977F59F8918FE
SHA-512:	F5A164069095C6BC45EDCA0BF8DA448EAD726DE1FBBE1E35F953D17399E528E89B1EFBA4B1F5922507AF51E5F49541A6F0745471E996AB60AB11853952EE43D3
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.8.5.8.7.0.3.9.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.a.2.9.0.0.7.-.2.1.d.3.-.4.2.b.0.-.b.4.a.a.-.a.5.0.2.3.0.8.d.b.c.5.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.b.8.1.f.8.e.f.-.d.4.e.2.-.4.b.4.5.-.9.f.d.7.-.1.2.2.1.2.3.3.a.8.7.9.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.5.4.-.0.0.0.1.-.0.0.1.4.-.3.5.9.6.-.b.e.c.6.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.3.5.c.6.8.e.3.b.9.a.f.8.7.4.1.1.c.6.7.a.a.4.9.8.2.9.6.a.5.9.6.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_3876214c-d790-41b5-b5e2-d2ed096deda4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9358833153649571
Encrypted:	false
SSDEEP:	192:srTpBynz2G8b3056r96E6jjC+ZrVszuiFhZ24IO8oj6t9:4dw2GmE56rwjezuiFhY4IO8L
MD5:	114B883C29964C7CA166C93254C2473A
SHA1:	CB2516F872E747F112D47E412767335EAC63E935
SHA-256:	CEDDF8EBDD491930818E22C75670B627D790E4A5D8E7C28DF0EED6572D8CB40C
SHA-512:	4065A987E45AF131603EEF512F4DD416DEED42C8C61181F14C65F07A51C25930F6E3140EFE7945D18B1FB5FCC4ADABE9CD51C674696A62BF97EEBEB73BD3E3C1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.8.4.0.2.8.9.0.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.7.6.2.1.4.c.-.d.7.9.0.-.4.1.b.5.-.b.5.e.2.-.d.2.e.d.0.9.6.d.e.d.a.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.3.0.a.7.0.f.2.-.9.5.1.f.-.4.5.6.7.-.b.2.e.c.-.d.9.c.9.6.9.0.f.3.1.e.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.5.4.-.0.0.0.1.-.0.0.1.4.-.3.5.9.6.-.b.e.c.6.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.3.5.c.6.8.e.3.b.9.a.f.8.7.4.1.1.c.6.7.a.a.4.9.8.2.9.6.a.5.9.6.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_4f7c52ae-a147-40d8-a3f2-8a9bebe00511\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8958607044708614
Encrypted:	false
SSDEEP:	192:2wOlpBynzU8b3056r96E6jjC+ZrVNzuiF8Z24IO8oj6t9:JOrwUmE56rwjvzuiF8Y4IO8L
MD5:	0A25ED3395E6039CD6B210E5BB9B56D5
SHA1:	2827EE9FC151061D1CDBC19AD391AE9C6D9160D0
SHA-256:	91B79A2B389AC6EB93765840B1105485FEE26B05DF2CE38328953A90198DB33A
SHA-512:	5659827748C68049C35ADC3A72631286DE96719F2D460103C2C5AEA4F21B9DE9CCC7B4331D416DB06551BC6A0CB7EF00E236EF0366A41D06F76A44359B245AA8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.7.2.1.4.2.3.4.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.7.c.5.2.a.e.-.a.1.4.7.-.4.0.d.8.-.a.3.f.2.-.8.a.9.b.e.b.e.0.0.5.1.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.9.c.3.0.e.d.b.-.d.1.6.a.-.4.c.1.7.-.8.d.e.0.-.a.6.a.f.b.7.e.c.b.f.9.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.5.4.-.0.0.0.1.-.0.0.1.4.-.3.5.9.6.-.b.e.c.6.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.3.5.c.6.8.e.3.b.9.a.f.8.7.4.1.1.c.6.7.a.a.4.9.8.2.9.6.a.5.9.6.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_79bbe31a-7538-472f-bc88-c4ceabe8f0b1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9232949440550894
Encrypted:	false
SSDEEP:	192:WIpBynz/8b3056r96E6jjC+ZrVfzuiFhZ24IO8oj6t9:3w/mE56rwjdzuiFhY4IO8L
MD5:	1D837AFA35A3A690EF0DDD6ABB26A6FA
SHA1:	83B981EDF1F7ABF20B4D60DE1D45EB0F4132E24D
SHA-256:	045800E78DF22191AB5CF2E9FF83A7CB88CDE688DB163D53DB31362C37698EE6
SHA-512:	FC4ECEB3525531C87CCD077C2BA8820AD5508AA4D60A3190E5BAE131DA7A5B68265ECD33403BE2C8BABFA417DA4CE5C13A08B2976B4D1D40DB2A148C8EA7AF58
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.8.2.2.3.1.5.0.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.9.b.b.e.3.1.a.-.7.5.3.8.-.4.7.2.f.-.b.c.8.8.-.c.4.c.e.a.b.e.8.f.0.b.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.a.d.8.a.2.0.6.-.6.1.2.1.-.4.6.5.9.-.b.1.e.9.-.d.e.4.a.b.b.9.e.9.b.d.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.5.4.-.0.0.0.1.-.0.0.1.4.-.3.5.9.6.-.b.e.c.6.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.3.5.c.6.8.e.3.b.9.a.f.8.7.4.1.1.c.6.7.a.a.4.9.8.2.9.6.a.5.9.6.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_7beb78b6-6e28-400c-9bec-333e5a1201c0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9431134629335274
Encrypted:	false
SSDEEP:	192:mnwCABynzk8b3056r96E6jjsQZrMVzuiFhZ24IO8oj6t9:PwkmE56rwjgzuiFhY4IO8L
MD5:	1C0D37EA84675E693A5472D2D5EFEB30
SHA1:	14956ADC5D90E24120CE502B9A2604FE17D37746
SHA-256:	61ED2C4062B23757675AB3659BB760F72623179B4383FD9F23315E3588BDF61F
SHA-512:	ACB3C9646C374F4C66E9362689FD9DA66D007FAFA174675BD3D356D715B2E35F3B4BAE98F825416DC26DBEBCA265056A62179BA0FBF1D5200E4333F46BEEECCA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.8.4.4.8.9.1.7.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.e.b.7.8.b.6.-.6.e.2.8.-.4.0.0.c.-.9.b.e.c.-.3.3.3.e.5.a.1.2.0.1.c.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.0.d.1.5.0.8.5.-.c.9.c.e.-.4.7.9.a.-.b.9.b.2.-.a.f.2.5.5.6.7.4.b.b.1.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.2.0.-.0.0.0.1.-.0.0.1.4.-.4.f.2.e.-.9.3.c.6.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.3.5.c.6.8.e.3.b.9.a.f.8.7.4.1.1.c.6.7.a.a.4.9.8.2.9.6.a.5.9.6.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_fa6f4377-f796-4dc3-b6a9-a4af4a149016\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9028528981541389
Encrypted:	false
SSDEEP:	192:4ABynzX8b3056r96E6jjsQZrMyzuiF8Z24IO8oj6t9W:PwXmE56rwj/zuiF8Y4IO8Lk
MD5:	5107584D16B79F2215436FD9A42C42E3
SHA1:	96B396756410F6780E6697CC6917DCD36B5F8603
SHA-256:	379CACE82DD5DB6A4E6DA8DDDF2A75B71AE57160B4A8D55E907EB19F5DAF9220
SHA-512:	ECCE3B87D0CB29E920E5A11DF1F4233DDD7C4470055926E6B129DFD824E5FFB36F88613599D3B7FBFE3417FE81747194F6294727E8097C49C2999A31DCBFC7FA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.7.2.1.3.1.3.3.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.6.f.4.3.7.7.-.f.7.9.6.-.4.d.c.3.-.b.6.a.9.-.a.4.a.f.4.a.1.4.9.0.1.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.4.1.c.e.2.1.6.-.5.3.3.d.-.4.6.a.b.-.8.8.a.c.-.e.6.9.5.5.4.b.b.7.6.f.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.2.0.-.0.0.0.1.-.0.0.1.4.-.4.f.2.e.-.9.3.c.6.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.3.5.c.6.8.e.3.b.9.a.f.8.7.4.1.1.c.6.7.a.a.4.9.8.2.9.6.a.5.9.6.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_fd7510c0-0ba9-4985-bc35-420bde20bbb7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9427517046049727
Encrypted:	false
SSDEEP:	192:CxABynzC8b3056r96E6jjsQZrMVzuiFhZ24IO8oj6t9:C2wCmE56rwjgzuiFhY4IO8L
MD5:	05653CEBD5C333E9361D19E131901C3E
SHA1:	F6193E95F90F0EA21115359CB9D1A2D023F81FE1
SHA-256:	350FBB2027473634F9DE86BDD3E23074FA5D0438B9039726081F4C5D1326F604
SHA-512:	8C951C6BAD42FA621193EDA1999B01A7537F5F5037B8C881D8A7E2338FA40A9BD44620A2A55C5E0DC93480F91117FF78B07D62ECD416D4E0F111CEB6FC66D1AF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.8.2.2.8.3.7.2.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.7.5.1.0.c.0.-.0.b.a.9.-.4.9.8.5.-.b.c.3.5.-.4.2.0.b.d.e.2.0.b.b.b.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.2.0.8.6.f.2.-.b.9.3.7.-.4.f.2.a.-.a.9.a.6.-.5.0.2.0.c.0.d.6.5.1.f.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.2.0.-.0.0.0.1.-.0.0.1.4.-.4.f.2.e.-.9.3.c.6.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.3.5.c.6.8.e.3.b.9.a.f.8.7.4.1.1.c.6.7.a.a.4.9.8.2.9.6.a.5.9.6.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_bf368937aa71444bfe4b5f2ea5f56432083d3_deda682a_99bc5391-f9a6-410f-81b2-90d93152f0db\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9090411992990994
Encrypted:	false
SSDEEP:	192:YhGatvc3056rgjsQZrMyzuiFhZ24IO8W:YQIvcE56rgj/zuiFhY4IO8W
MD5:	60E21E003D3DABCCB1938DEB9837FA7C
SHA1:	A0E1A1BA86739FD9BA01B0811B4ED60B57647D6C
SHA-256:	0082DA0B50A37443E8FEFD97173F7F058D9EFABAB97B4D7F4F34815B9DD11061
SHA-512:	557EDB9BFFC70A7365F00C2DA07B8EF61205638A77D54B80BBEE3E10AD2DD6C083EC5BEBB16943C1747029D9B8CDE9952E9CDE9558907E7FB4CFE1E36AC5E52A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.8.6.8.2.9.8.5.2.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.9.b.c.5.3.9.1.-.f.9.a.6.-.4.1.0.f.-.8.1.b.2.-.9.0.d.9.3.1.5.2.f.0.d.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.8.b.4.0.5.7.3.-.6.0.3.8.-.4.6.4.0.-.8.5.8.c.-.f.0.c.d.a.7.0.3.b.1.c.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.2.c.-.0.0.0.1.-.0.0.1.4.-.9.6.a.a.-.a.1.c.e.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.9.8.7.d.2.9.7.1.8.f.7.0.f.d.f.f.c.3.0.5.6.7.d.e.0.b.8.e.d.4.0.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.R.a.g.e.M.P.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.R.a.g.e.M.P.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_7c2eca60-39e2-4891-80ad-9cb598a01ab4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9230038541149752
Encrypted:	false
SSDEEP:	96:qLSfAYAsvbqIoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/wWGTf3hOycoqzIPEVsJ/j:TfAnb3056rwjsQZrMwzuiF8Z24IO8n
MD5:	10029DC9ADDEE6E51EA61E9DDF8C5750
SHA1:	649D94AADE8A7EC854CA73C8622F9BF8079D4F09
SHA-256:	CE43CB9E0C9164646AFBD7534442CBED6348664401CB544E56C280149B4F59E9
SHA-512:	513B7F867CC439E9F1F2CEFCFACD2197BB94B3F365276CBF60799DF7739F5B58316E2B2139CA010B4045A6A33FDB4888D4E34F058B2A97683691289C2372B92F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.7.7.4.2.9.9.0.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.2.e.c.a.6.0.-.3.9.e.2.-.4.8.9.1.-.8.0.a.d.-.9.c.b.5.9.8.a.0.1.a.b.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.2.7.8.e.d.2.-.0.8.2.7.-.4.c.2.5.-.a.2.2.0.-.d.d.1.e.f.0.8.0.e.a.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.e.n.d.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.4.-.0.0.0.1.-.0.0.1.4.-.f.d.d.5.-.d.6.c.4.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.c.3.3.a.6.5.f.a.b.5.0.8.4.d.0.a.a.f.1.c.7.6.0.f.a.c.c.8.1.5.5.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.d.e.n.d.y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.d.e.n.d.y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_93f7b6c4-5ced-48d1-a491-d06e46313ed7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.016977113156388
Encrypted:	false
SSDEEP:	96:qCFPfAysvbqIoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/wWGTf3hOycoqzIPEVsJ/M:tfAyb3056rwjsQZrM6jzuiFhZ24IO8n
MD5:	01175838648C36DA7A1A4B74E47C52FE
SHA1:	0E9D7B1F40FEDEF4B54EB41325475ABC8E6F4705
SHA-256:	E4C8EFB5FDE6CD0F91B3E6ADEDD838F841006DE6660424437E39E8EA9A496873
SHA-512:	385197F1AA11129BEEA6D1E57A006573013D6878434A3C5FEC60293E33B21735CBBB39F298F8691B7D1C737588DADCC103E7DC3CD1814790182079B03862746B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.8.6.0.1.0.0.9.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.f.7.b.6.c.4.-.5.c.e.d.-.4.8.d.1.-.a.4.9.1.-.d.0.6.e.4.6.3.1.3.e.d.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.8.c.a.2.b.9.1.-.5.6.4.1.-.4.7.6.1.-.9.d.d.4.-.3.0.6.9.e.6.f.7.b.0.2.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.e.n.d.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.4.-.0.0.0.1.-.0.0.1.4.-.f.d.d.5.-.d.6.c.4.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.c.3.3.a.6.5.f.a.b.5.0.8.4.d.0.a.a.f.1.c.7.6.0.f.a.c.c.8.1.5.5.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.d.e.n.d.y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.d.e.n.d.y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_985b3f1e-996c-4fbf-b6be-01ab57397a69\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9434800621205717
Encrypted:	false
SSDEEP:	96:qdjifASsvbqIoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/wWGTf3hOycoqzIPEVsJ/R:EifASb3056rwjsQZrMFzuiFhZ24IO8n
MD5:	AC6F27C9FE6717CB38C815D9AF3817FB
SHA1:	75EB922AF45765B14DA354390C648FD826F47931
SHA-256:	792EE724AE47FAAD7369A87981EFD3C1B4627D29E12ADDE8589EFA665BB0A203
SHA-512:	12E70473FE65E8CB97C57A2A3F97FA297B1515708441E13E2DFC8B86797E28A2094796D6C30DE638659816B8A8F8C62C56FA64D63C8B5BCFA5BF4DA7F9EABE19
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.7.9.5.1.2.8.2.5.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.8.5.b.3.f.1.e.-.9.9.6.c.-.4.f.b.f.-.b.6.b.e.-.0.1.a.b.5.7.3.9.7.a.6.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.a.4.0.a.6.c.-.5.c.0.d.-.4.b.0.8.-.9.5.3.e.-.b.f.4.1.4.e.7.3.c.3.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.e.n.d.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.4.-.0.0.0.1.-.0.0.1.4.-.f.d.d.5.-.d.6.c.4.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.c.3.3.a.6.5.f.a.b.5.0.8.4.d.0.a.a.f.1.c.7.6.0.f.a.c.c.8.1.5.5.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.d.e.n.d.y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.d.e.n.d.y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_a37fdd3b-65f7-4f64-b95e-eddc769fb9af\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0108014820218294
Encrypted:	false
SSDEEP:	192:1bIfA0b3056rwjsQZrM6FzuiFhZ24IO8n:1bI40bE56rwjzzuiFhY4IO8n
MD5:	6C58DD5D7EB3F085A9D54407D34BCCC9
SHA1:	E4351C60A66A9D54E8082235EFA806579BEBDA51
SHA-256:	26ED42CF472F3F82991CC74139D3653C9C6FE06B2717C56A7DA3FA3792A5483D
SHA-512:	2E7D5419BBFB177A75E21D71047C4A5D247BED51A31F496FED596E1D3D08E259C131F668D5E3D1EB37F8CCB0E11F787DC8806AD4F7FAADCD962C528EF0E6EAB0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.8.3.9.6.3.1.8.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.3.7.f.d.d.3.b.-.6.5.f.7.-.4.f.6.4.-.b.9.5.e.-.e.d.d.c.7.6.9.f.b.9.a.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.5.c.e.f.2.0.-.f.4.a.3.-.4.3.7.5.-.b.b.c.7.-.4.d.7.8.5.b.7.8.5.a.2.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.e.n.d.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.4.-.0.0.0.1.-.0.0.1.4.-.f.d.d.5.-.d.6.c.4.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.c.3.3.a.6.5.f.a.b.5.0.8.4.d.0.a.a.f.1.c.7.6.0.f.a.c.c.8.1.5.5.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.d.e.n.d.y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.d.e.n.d.y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_a7d04d5a-b292-4a7f-bb04-f331e1e6070f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9169620869823485
Encrypted:	false
SSDEEP:	96:qtOO/G1fAasvbqIoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/wWGTf3hOycoqzIPEV7:LfAab3056rwjsQZrMSzuiF8Z24IO8n+
MD5:	C7C97A06B475F7EB47B013AB3385A0AC
SHA1:	AD572DCBC41CAF56F4EC17D5EB4C919236E736A7
SHA-256:	394A452AE65AD166BD12CE03960BDE011898EB1A0DBE65B0232FEA315E29B6A2
SHA-512:	CDCAC899AE04DB8A6A8B6F7495DCB51AEBA1D22DF573B57292B79B67F261C794620C2BE9CC07D1124CDF59BA7B15747D8C864A242D43BD9686C9636CE0716D81
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.7.6.7.0.5.8.9.5.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.d.0.4.d.5.a.-.b.2.9.2.-.4.a.7.f.-.b.b.0.4.-.f.3.3.1.e.1.e.6.0.7.0.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.d.8.c.a.5.a.b.-.b.3.7.e.-.4.b.4.0.-.8.b.1.d.-.d.8.d.5.6.0.7.b.b.8.f.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.e.n.d.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.4.-.0.0.0.1.-.0.0.1.4.-.f.d.d.5.-.d.6.c.4.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.c.3.3.a.6.5.f.a.b.5.0.8.4.d.0.a.a.f.1.c.7.6.0.f.a.c.c.8.1.5.5.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.d.e.n.d.y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.d.e.n.d.y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_b0018fe4-ab49-4a41-be81-253da0997ded\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9428149163143585
Encrypted:	false
SSDEEP:	96:qODmyfAHsvbqIoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/wWGTf3hOycoqzIPEVsJp:PLfAHb3056rwjsQZrMFzuiFhZ24IO8n
MD5:	2BFFC909A5C84B31C411DD9514085986
SHA1:	0E92B289DC4017BEE3086218531F6D4733FECAA3
SHA-256:	0304A2D5F80232C973CE8CAD431D96C4A31D834307988457802B45D0B884B687
SHA-512:	6787284772ABEC978FD33B6732DE81276240CA44F36B61CD591C6CB3AE010DED8547CCBEE8E103C3C475195110D416A16714C0B4A3FB2B73B9C37F4F55E72CAA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.7.8.4.2.6.5.2.5.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.0.0.1.8.f.e.4.-.a.b.4.9.-.4.a.4.1.-.b.e.8.1.-.2.5.3.d.a.0.9.9.7.d.e.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.2.7.a.4.e.5.9.-.7.4.d.4.-.4.4.f.e.-.9.5.5.8.-.a.7.3.3.5.a.b.1.0.c.1.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.e.n.d.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.4.-.0.0.0.1.-.0.0.1.4.-.f.d.d.5.-.d.6.c.4.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.c.3.3.a.6.5.f.a.b.5.0.8.4.d.0.a.a.f.1.c.7.6.0.f.a.c.c.8.1.5.5.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.d.e.n.d.y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.d.e.n.d.y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_b25a0167-156e-47da-8b75-d9e08c1e0ac7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9030717358502968
Encrypted:	false
SSDEEP:	96:qgH2fAZAsvbqIoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/wWGTf3hOycoqzIPEVsJT:t2fAeb3056rwjsQZrMgzuiF8Z24IO8n
MD5:	B854CA7FBC9E503B4F84073659DBB0DD
SHA1:	7E3D2A33E8858735F58EBC369F8673FF95965761
SHA-256:	C94CBBC59423AC47851D994153081B07003877E5F7C373FC7593D78339E0144E
SHA-512:	37E37859A38002BC464FC37997685EBE2E67CB980759D2DA36927F360DE536390FA4484AB81B7BF977EA8F4778F3095D8F3097DCD9B29F58A96F36B18FDFF0ED
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.9.9.6.6.7.9.9.2.7.3.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.5.a.0.1.6.7.-.1.5.6.e.-.4.7.d.a.-.8.b.7.5.-.d.9.e.0.8.c.1.e.0.a.c.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.f.b.d.0.a.e.-.5.b.4.6.-.4.b.1.4.-.8.1.1.5.-.e.0.a.c.5.5.1.f.f.5.a.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.e.n.d.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.4.-.0.0.0.1.-.0.0.1.4.-.f.d.d.5.-.d.6.c.4.6.3.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.c.3.3.a.6.5.f.a.b.5.0.8.4.d.0.a.a.f.1.c.7.6.0.f.a.c.c.8.1.5.5.0.0.0.0.0.8.0.1.!.0.0.0.0.b.9.5.8.c.5.2.6.2.2.a.0.2.d.7.e.d.5.3.0.f.6.d.4.1.a.7.e.7.c.2.4.a.2.7.f.7.9.1.8.!.d.e.n.d.y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.1.2.:.1.2.:.3.6.:.0.6.!.0.!.d.e.n.d.y...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37F1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	55822
Entropy (8bit):	2.215749897079498
Encrypted:	false
SSDEEP:	192:PxFEQXn9wHeR67d19OiQTv4i7dsqGPmS7buz/NfB8eWSlK8elCVXevRlACGuLj:5FEres7YZTvJdsqGP8NfBjelCYACG6
MD5:	E8E21435B7D413A663E9DE38020FE4AD
SHA1:	AD7CFE389522E102976B5F07648FE3320A782C8B
SHA-256:	63352105120E2A6D51C735ECE3B279C06EF7A1D7C9F42E7899414FF27737D4D4
SHA-512:	9BD4F4CB424FF7D52E0BD4DBD6A93327F180A69551CF29FA649B97D40C415E7D0E1A6C73CF4D1D672AF72B7F5BECEDBA8A96DC3CAB5D1FDE84F9F323549C64E0
Malicious:	false
Preview:	MDMP..a..... ......... f....................................$...l...........00..........`.......8...........T............!..........................\|...............................................................................eJ..............GenuineIntel............T.......t..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER390B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.6988399852167597
Encrypted:	false
SSDEEP:	192:R6l7wVeJW6q6z8y96Y9FSUGwgmf5XCpBM89bhcsf6Lm:R6lXJ26B6YfSUGwgmf5shvfP
MD5:	2E9185905934D5C2038F40245DD47CF5
SHA1:	F94F4BF1DB7F982276264C673DAF11C53D3C4AC8
SHA-256:	C2C49C27C363D32769819DE3DBCB406DAAD0EC36E2BC91AA596D7D908D8D6429
SHA-512:	44BE7D7C85A12BB17DC7BB3411C33F95A3BEDA2216FE6799E9D57FE4082746292A1B0ACDC6F6B2841C0AC15F25663CDCD3461BE4A25038236D9DD12627DC7B8A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER396A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4596
Entropy (8bit):	4.470057847329761
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9YDWpW8VY5xYm8M4Jq4FC+q8N7WTqcHjd:uIjfKI7ey7VewJk6TcHjd
MD5:	EAB8965473A5F00241D6A594DC5995FB
SHA1:	889C869FD35C3D584F9918DD64AEB335EB9E3CE4
SHA-256:	27FD031243F6EAD4A6665E3B09A91FB4B3249695BEA584EE5DA59C7ED05E7095
SHA-512:	6588C4C53DF69E24FA3685188AE96861E6D934877F9D6E0FC422D566501FDA36908394646B05BBDFB52BC6DF9954475D60D34DFCFDB6841D86889FA4844D72FB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285043" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER481D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	54088
Entropy (8bit):	2.1977983634580123
Encrypted:	false
SSDEEP:	192:7hV3Xu7DJTOGAhMROuQTv33F3T6A2uiONsef6S/3/KPHOneWSYAUNUB4iC6YXuf:TEZOGq9NTvxlsC6y3/KPHOpNLZ
MD5:	1F337C70CD872B9A8639DCD8D19E95D4
SHA1:	0D86BF5AAF11AF6077E004F3648A03F60862D147
SHA-256:	5D17A6CCE4FCCE1EC8104E02163979645D51A057F8FAB82E36A7CE48A8A9E4AA
SHA-512:	CED56D9215984C9551660EBEFA846F3F3A5F0B4A1D19D9AC6A695D0092A711F4524D4345FDE204F21D40D5BEC5E5F02421D55C5E6EC19A3389EE4B5E04F3748C
Malicious:	false
Preview:	MDMP..a..... ......... f....................................$...............&/..........`.......8...........T.......................................................................................................................eJ......<.......GenuineIntel............T.......T..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER487C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6340
Entropy (8bit):	3.725901227853638
Encrypted:	false
SSDEEP:	192:R6l7wVeJRu760oxYiXXCpBT89bqfsf1wjOm:R6lXJU6dYYhqEfST
MD5:	31F21297F2A787DA53C49F0F396060E9
SHA1:	B53C27EA3282AA4068ADCB0982A4804C8DE70F7C
SHA-256:	3BBC8D44109EBC0A0C4C8FF58C9A025EECEBD37AF7417D42B24BECC659AD05AF
SHA-512:	C0086ACD2F9EB95060969213D98C1DFD23ED5CF7457B0BF124D6606C023C8BEFF42987B1E614D38543A9306DC15A79674895E41D7BA38BEC21E8E186DC00A529
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER489B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	54524
Entropy (8bit):	2.1917046961977245
Encrypted:	false
SSDEEP:	192:78lXSTHwzXLUswcROiQTvDr9sYj+8WV6sV2Q/N3KVL6eWSkiWYb3wXG4tQe:4tXLNwNZTvD7u6sV2MN3KVLgYzmae
MD5:	0FDDF5852FD035C5D9E9EFC033C0BA33
SHA1:	C8C71C8E61719516B1E9A925F7A1CD088C1C45F5
SHA-256:	D0B72F6417F049E1E42DDFCF538A6F223EEDA728EFE1DB62B0E5474FE50D593D
SHA-512:	354B6F73AA2DC9485FCA8F83D439FE25F46F8F94F6C7364C046C68AF91C72329F65DE777AB8DD26C3163093B0DEC98409008D5ED4B427DDDF5DC687EF07AB88D
Malicious:	false
Preview:	MDMP..a..... ......... f........................(...........$................/..........`.......8...........T...............4...........$...........................................................................................eJ..............GenuineIntel............T....... ..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER489C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4611
Entropy (8bit):	4.493762161853503
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9YDWpW8VYVYm8M4JS4Flx/+q8mWpIq3CLd:uIjfKI7ey7VhJjlQv3CLd
MD5:	7AB123A945BD3CF63B430B57256002BE
SHA1:	9DB618AA8E93604093FCA7E351F2C1B1E358F058
SHA-256:	FB77DF1F09663AEB34AD80573CE670BB9A1C511444F29846182439AAB8E401FF
SHA-512:	5559AF46D9D26687993E442346A9202A8A350DDB51C7A93F10CA3D8DBCB62482DBE520598583CD43D83819D232736B333B6ECCB17BE096EBDDB50CCE424D5DBC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285043" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4987.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6340
Entropy (8bit):	3.725406747922147
Encrypted:	false
SSDEEP:	192:R6l7wVeJpu86CrzUYiXXCpBp89bq+sfVOm:R6lXJb6iUYYTq9fl
MD5:	0C309BE44B49DE4F7745A445E77B02BA
SHA1:	187349E98643383C89E6D42BABD1D33F2EE287BD
SHA-256:	93A55916C334F3A3AF604D8A013694B76E4C9E0EB70CB8D0EF001BDDB32D8856
SHA-512:	3C5977E6DA38B2A1A2D5E5E45E26DF16D2F3734652747CEAA7C27465A929F3FC75FFD7D5705E86E8736A69A16B71036E6A07B314C1BBAE8C097B0FB995B18440
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER49B6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4611
Entropy (8bit):	4.495693265904442
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9YDWpW8VYOOoYm8M4JS4FOe+q8mbUopIq3Cydd:uIjfKI7ey7VtyJsezv3Cydd
MD5:	31AF8816E6ACD9DE211A6DCC1E0F9F24
SHA1:	ABFBA84EC83A4FB0FFE322580FED79AD5B95C5A7
SHA-256:	007B560DBD89B77ADF6896F17D3D9F52B876C8406DC6E6C981393BB65FAC3E95
SHA-512:	4E420F3D1AB7B3D0C47A2AFF84D40DAE25592501714A8C5269A91B2FCF84BE015E966A8FA1EB49407981411AB58BA52812A9635E164EAA0199FDA4935F5127BF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285043" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER59FF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	67426
Entropy (8bit):	2.261975042628922
Encrypted:	false
SSDEEP:	384:L4DbMuZaLZTvk3ERsL8aeJYb2jUbV14eIFwxLYZf:LIMHLZTvk3um822QVdxa
MD5:	449DD8B073A74DE708E2661031320F87
SHA1:	E08B2C40B5C5FED09F05E2DF1C0AA861BBC3D6BD
SHA-256:	B40B7900F7316CB553A868E68EA6DB984B665C29C0706D3D171D375BA93EBA1B
SHA-512:	E10BCBF36E1852A8DA731D99D85337BE0CBBB89B98DE075FA1648D0DFCC10F53565D308E71B54FF623B3523786E69CF9B3610FDCEA986E5A16A762FF2C5722CE
Malicious:	false
Preview:	MDMP..a..... ......... f........................l...........<...t.......4....4..........`.......8...........T............%..........................................................................................................eJ......4.......GenuineIntel............T.......t..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A5E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.7016173691267147
Encrypted:	false
SSDEEP:	192:R6l7wVeJW26k6Y9nSUKmgmf5XCpBt89bOcsf0qam:R6lXJf6k6YNSUKmgmf5fOvfb
MD5:	5D929063D2B4CD58F47B987AED7BF646
SHA1:	771EB53CE245F84A0AD5BF9ED61B1A8C37CC45EA
SHA-256:	05764EDE5EB3D55FC8AB8FADD774FAC58934B822B2127E791009EC509624D62B
SHA-512:	9511CFB04BB0B68AA3CA79F8A07E2848AD6AFA8FF0A69E4D18B83A9620D0DA1CDA54720B6754C8C9E4A5D4589BAC474153A61415A7790A6C5E4119A09CD71853
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A7E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4596
Entropy (8bit):	4.4708005577497785
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9YDWpW8VYJYm8M4Jq4FR+q8N7WTqcHjd:uIjfKI7ey7VxJj6TcHjd
MD5:	95091E488FB7F3438318428BB38B56A1
SHA1:	3E68B92F5EAF2133D976266D57F6211DF63340ED
SHA-256:	7C13F1455EF0B9E4750FF00E208907D19FADF0C6E5BB4B06A2C180CA82FEADA0
SHA-512:	EDB113B9300DD50F923EC44B0DC583B5DFBAA062B4F2F8C61588EFF1FF5F86FEFD640E3D41D769B5FADDEE9195F5F24E609CA9B6C2F0A01E5136D4D34832CD70
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285043" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CDE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	73658
Entropy (8bit):	2.211965102690138
Encrypted:	false
SSDEEP:	384:tOE79LUU0CZTv4T95sNSXuib2jUbzOezxTdj+SdR:tZJ0CZTve95VuC2Qznis
MD5:	20C217E4528F4D17157B671E33CD6336
SHA1:	1DAC38F0EB7E09390B6415AC4EFD304249A0EC49
SHA-256:	F9121E92705D8147C2B1B6026FBA2817D08DBD78A469FE01D03BF2EC3C5374F6
SHA-512:	F235B1B6A316AC3BB594BFE1058A7A0BE9201622E41D00658B4D1692B505A975BE5CE1AA116104DDCF157A37E89D7F4BCE7FAE2023B18B2B595355A8F022ED60
Malicious:	false
Preview:	MDMP..a..... ......... f............$...............8.......<................8..........`.......8...........T............&..:...........L...........8...............................................................................eJ..............GenuineIntel............T.......t..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E08.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.69951242656345
Encrypted:	false
SSDEEP:	192:R6l7wVeJWG6Alu6Y9WSUjR4gmf5XCpBM89bXcsfbdm:R6lXJP6b6YMSUjugmf5sXvfM
MD5:	0B1B50E4909863960CF85317298BD67F
SHA1:	3F155B77E8F80DF77058DF9A584D01F73431ED41
SHA-256:	FFD9A5C0E401C83C49FF5885BEF390A75B39AFCA930D6916D4DBB09D8A16C128
SHA-512:	C2E5CB2AE29581A7864DAFEEB3173E3BE41DBB9C877388D3056623DA6FB78466BF768E206A3B9ADDD5337C27988D1B39E78F447FD28257AA94F2BC7CFBDE3780
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E28.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4596
Entropy (8bit):	4.468625541018724
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9YDWpW8VYG5Ym8M4Jq4FX+q8N7WTqcHjd:uIjfKI7ey7VqJ96TcHjd
MD5:	19488622890D91CDD6A01713C9EA4663
SHA1:	F81C5C84587D932F7934CBDBADCC05586B07D562
SHA-256:	51DEFF10212A19518874427BF90DB3F7141D810328F8BB9854566479DCC78C8C
SHA-512:	18E5D79EA9DA4598EEBBD5C1F32D76C374D711BE2502F31D38AADE68D6E7C217037AE51BB743DA695F302866E5CF3A5A63E9109955BFD273BD70535C00656ACE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285043" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER60B6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:18 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	78452
Entropy (8bit):	2.1283242913443066
Encrypted:	false
SSDEEP:	384:0DqsE2ZTvxRwRtsOXh9b2jUX50eW/8WA8kKRQ/:0+p2ZTvxORtnJ2c57se
MD5:	7500C8DE4B1375152AB266089E6E0885
SHA1:	37F65F29C3C35CAA720519AA494666DB7D0409D7
SHA-256:	1E2D652AE9EBAB2AF8066949C54C1FC581F61A2A6A8BE215F7D1A3D2ED146D1A
SHA-512:	B79EC39380BF125FB46F09B0E8DAC75B74F0D7453E1691C8E81C0F89AF5A74032D0BE024AA77506A1CFBD2324C4F79B45711CCC021FE3C7139C7096DDABA7F1A
Malicious:	false
Preview:	MDMP..a..... ......... f............T...............h.......<................<..........`.......8...........T............&..\|.......................................................................................................eJ......D ......GenuineIntel............T.......t..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6163.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.6994471983449753
Encrypted:	false
SSDEEP:	192:R6l7wVeJWJ6ss6Y9cSURngmf5XCpBy89bAcsfHKAm:R6lXJw6ss6YmSURngmf5eAvfHc
MD5:	E2889841B4E315DCBA9CC827A830ED88
SHA1:	DCA5344BD2F2F5384C8D3448CCF80439191A577F
SHA-256:	14179BF13E36D5AC352FFE48F3DBE988FBFA760C26BF07097E809E5F715FBB94
SHA-512:	E9068F48391BB9F850BC4E2B127B857C902C5D68D9D3A64A644E7F5371730A1F6B36297C6649D75F87BEEDE726ECF7908556C6E522C948A487E87A5CDC5DD1A6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER61C2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4596
Entropy (8bit):	4.46977177370598
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VYPYm8M4Jq4Fsi+q8N7WTqcHjd:uIjfzI7ey7VLJWi6TcHjd
MD5:	F4F9494A1D985C14DD2F73AE1C779B4C
SHA1:	82B91CE5F94F80E0B8E6C5820228E846AF0402BF
SHA-256:	F8E348B56C7ACEA21D03164BEB77A0FE5B5A79B0DB09E636B6C55DF3ED9B73C3
SHA-512:	3C73665F4D64AF05ECE7C192186C6A7E1DE404938B159EA6FC438FAD1CE1F568C50114D2CF65017481D95977A99B2826411B412B59652D5153B45CA73F4C8123
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER671F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	92162
Entropy (8bit):	2.2546870648958346
Encrypted:	false
SSDEEP:	384:hb9p4UI8ZTvCqOo+swoot+mTiM+h6tFdjwX5+seW2IExAuYL3FQg:hxmUfZTvlOL/iM+ItFdY5kAX3h
MD5:	7A74C4E195F5FD34FEC51A4E4DC64207
SHA1:	F5793D8898825426459A8C985A635783CB419AD9
SHA-256:	08EFA06B05028B94D0EC0BC6431BC2BF98D2DA7E8C269CC46B20AC9EB9833758
SHA-512:	DD14B999B854AB467FF6BB9EF505D8A976EA958836D1EF46E723F6D4D7A1F35852C0C4205AEE9B7D05795193906C3FB50D4A44C5A995EC1DDA6F4C4863E42F49
Malicious:	false
Preview:	MDMP..a..... ......... f....................................<................?..........`.......8...........T............,...;......................................................................................................eJ......t ......GenuineIntel............T.......t..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6EE0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.702512505464872
Encrypted:	false
SSDEEP:	192:R6l7wVeJWV696Y9iSU5+ggmf5XCpB089bZcsfHnTm:R6lXJ8696YISU5Zgmf50ZvfHK
MD5:	3844250097AEED7CF22595CDA3BAF181
SHA1:	796B90AF955A5C3EDDE818FD5D8D2DE509DF939C
SHA-256:	E98661BC155FCEA6EA48AF64506D436077939FF4CD9994D010E3B78A7F69EF68
SHA-512:	7CE91A838D9EAABBEEED62DC84D40DEBA0A457F788A57EBFDFC4A1391FA8C2642FCA63A4338BE3ED7440A69C578D53444020DA35B0CC528C09E88B159053415C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F8D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4596
Entropy (8bit):	4.4697047566036705
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VY2Ym8M4Jq4Ff+q8N7WTqcHjd:uIjfzI7ey7VOJV6TcHjd
MD5:	11377DEAA894AE8DC99A30DB6D8FFD44
SHA1:	4D02B4460B00E308C35000515D3EC090A7DD7838
SHA-256:	2D972B0BD3961325E6065422EAE937EF7147807D8BAE0331814E9E05E764649B
SHA-512:	3693E61E519767DB26CE127A7EFA77B3BF1FD0233A89CD592BA42C0E868EE967117B2E30A8B1174E02E3105D4AF7A073AAF497A3DEA4CC4F115C0AEC43ED1FB5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FC9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	66594
Entropy (8bit):	2.291274042270963
Encrypted:	false
SSDEEP:	384:uhYR4WwNTvAXBPsLXps50YjJWKBGOWKWlxzMUk:QYaWwNTv+B0SyYwJOgxzMP
MD5:	2B6723394AB1B2FE506E097D921351DC
SHA1:	B75E7B62B0BD0398D9744E44E7B56A901676579B
SHA-256:	44E96F2E84246B5696FD97D3D6EDF4865850FA088F87F6EF83A90DE4D19C15B6
SHA-512:	2FB00B60C38012F6CBAFAC143C4C35FDB79FCA03411C8A837C2CE935121259BBA8B6ACD7E7A4440B15B9AC0E21A8D5FE732E682E22044449C140791B6E85D85B
Malicious:	false
Preview:	MDMP..a..... ......... f........................l...........<...t.......D....4..........`.......8...........T...........8#..........................................................................................................eJ......4.......GenuineIntel............T.......T..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FE9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	72002
Entropy (8bit):	2.1487298432014805
Encrypted:	false
SSDEEP:	384:bDlG6SZTvmmwNqsC/TrAdNbnjyyKjv2e1sQp:bJpSZTvVsq1ADbnLkvCO
MD5:	9E95DF04680783C51BAC4EF74D0D4CEC
SHA1:	CB1EBE1E7A2C8D206B273C9876EF7FA7FB82BD6B
SHA-256:	9CA53E967D19D7BDEAC671B1878844148130487AC9AEC78F76F6D3F612912AB5
SHA-512:	3C7BA15DCE73198AF47574171045CAEB03984C7F107B6755092AE159E0682729E8536BD677557AF342359A90FE4DC899B801D4AEA9AB681C71F73151D8A9D230
Malicious:	false
Preview:	MDMP..a..... ......... f............$...............8.......<...........t....9..........`.......8...........T............$..............$...........................................................................................eJ..............GenuineIntel............T....... ..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER71BE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6344
Entropy (8bit):	3.729739501472264
Encrypted:	false
SSDEEP:	192:R6l7wVeJRuj6m5XYiXXCpB589bZfsfh2vTm:R6lXJk6AYY7ZEf9
MD5:	E1332BF5B2FD823A2157432D90EFACEE
SHA1:	08B57408A1BA2E1A1B4ABAF6B397EFB6A1616BC0
SHA-256:	557EB9C6C280720E5E0753EC0A4BAAB3B8A525E11A21FA8EE2134F09EA280EE0
SHA-512:	45F2FA362142AF1C5D38FF840C859E16B84713C3AF9756AABCA5F18007768F8AA44DEFDA090DCEB08404E3C32CFC93DCB8F175EB2026D031344E90BEF102E4CF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER71FE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4611
Entropy (8bit):	4.494166477849673
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VYwPYm8M4JS4FbS+q8mWpIq3CLd:uIjfzI7ey7VEJYQv3CLd
MD5:	7E47FA8C4A7F61CF0A88AF2A42601A51
SHA1:	735C705DA4128F1D0F1EBC1B0D7F63954CCE4D82
SHA-256:	A7ECB16FDFADC16799F364C2046EBF58CE3FA4A35C731795ABBD9461792EE5E5
SHA-512:	916AE4B0D38BCF385B46538BDFC63EEA5EB8891925817F25ED9BE0755270D898F33843E4A8A1A170389139F2FF016D96B1C27DC0DAFF21F9FE2CCF51DCDF68C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER722C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6344
Entropy (8bit):	3.7297418345215165
Encrypted:	false
SSDEEP:	192:R6l7wVeJpum66tYiXXCpB689bZ+sfSrTm:R6lXJJ6IYYOZ9fSO
MD5:	70D63ABFFC3EB6D73DF55C152C3E0B8B
SHA1:	D2930545CB069CC0D55EF78234C3251C54CF6363
SHA-256:	0A5B2B3D8971E7E7287D59C627BC47C483C8752844E94EBA1B002EEC50DE5158
SHA-512:	27C204B8337A29F61F1682695078E80F669E64FFDF3373E5190C9D722AC9202EFF0D0633B09FE7F362D8D1EA9B7853734947369891C70F3815CB46FFDC60C51F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER725C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4611
Entropy (8bit):	4.4928726725102255
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VY6Ym8M4JS4FBaR+q8mbUopIq3Cydd:uIjfzI7ey7ViJ3aRzv3Cydd
MD5:	72CFADCE5D565651D192DE47C9DAD5DD
SHA1:	74B147B1AAFFD99EDFECD4AE89E76ACE950C0EDC
SHA-256:	42816361979AB29787A2A2FDF924D1DC9372572F93B76E099B261E4D6E7B5817
SHA-512:	D94313B60AD0329E4BA1CC3EAA96E92618C6DB5BCD1435924E7D9843B464E7D3F9FF3D2008EFBB66F64CC58C05BC092E54FC5E9F7870576A308FB722A74E1022
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7651.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103548
Entropy (8bit):	2.2126704676703515
Encrypted:	false
SSDEEP:	384:GUvZM7ZTvCsy8Ryiu+Efv1qz4FTsRTjwXS0eLtzvAPOZq2pKsUrSrZukmb+:Gcq7ZTvCs+iu+EfgcUYSvvRlP
MD5:	9BF02C953065B76D44734A3A368ED519
SHA1:	6F30092F852F5A89197D4B790F34F639C69D2E61
SHA-256:	F4DD7277A4FE24E028BFAF33F48B6D5593EB2E675D6BEDB29E6592E43D73CED4
SHA-512:	E980A512A6AF3B294B1B91169234B3C9B93F37806D490AFB3F76D5EDE064CBB065B8A38865F1BF0A172D217FD5E66541094DAF92C2A4E8B85E8975725D55D0A1
Malicious:	false
Preview:	MDMP..a..... ......... f........................T...........<...."......t....G..........`.......8...........T............<..lX..........X"..........D$..............................................................................eJ.......$......GenuineIntel............T.......t..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER76CE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	77182
Entropy (8bit):	2.0962915181565953
Encrypted:	false
SSDEEP:	384:oXYe1kMNTvd7ri0sWtg0YjaWKBGOWCCj5iPR:oIOkMNTvd/XBYzJOz5
MD5:	4E87773C8E5C98BBB810BAD4D0840CCF
SHA1:	8B2AAB67B87ECDD95D646DBCB99215AF8CC48721
SHA-256:	2C946A2ABBA107D3DFD810863D92CBF72AC777239A7A478498F1161E3074B20B
SHA-512:	1CFD30640D7E0F77603E6F190570CA244DB1B9986C5BF281745C2AC861FD433E91288B319B997612EC9F8B39F2F1CAB2DF158CBBE9128618E42293B06053D126
Malicious:	false
Preview:	MDMP..a..... ......... f............T...........D...h.......<................;..........`.......8...........T............#..........................................................................................................eJ......l.......GenuineIntel............T.......T..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7885.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6342
Entropy (8bit):	3.72666413430986
Encrypted:	false
SSDEEP:	192:R6l7wVeJRuHd6+SaeYiXXCpBZ89bvfsf7hFm:R6lXJq6XYYTvEfm
MD5:	79C74BAFB5D1B421B5773520D4E5BE94
SHA1:	DA3D079C9BAAD81B25A406CD17AE6F6DA8C42661
SHA-256:	2DF0B36C57017EF3C8DC1C8C88A0BF576D5112F1CF36F26096E8A07D29F0BAA7
SHA-512:	62D3DF98AAA9AECB918B1D2382D0F515B214E343F0AC93028E102636F91C9C65DB87B5E9CC2A4372A78ECDD57C809952EEB10DC9C9F1FA6D86AFDA22BBE45DA2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78B3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	77618
Entropy (8bit):	2.095853811567573
Encrypted:	false
SSDEEP:	384:tzcwuqYdUZTvyYw2Ef4NbnjyyKjv0sBzTe5llJINA7:tYwRkUZTvhTfbnLkv0CG97
MD5:	C11F3EEB38164B956CEAC3EF7356D05E
SHA1:	DBE1AE2A94541A65D7EC48868A44D23816EB8EBA
SHA-256:	B6D293B28377279FE0EC0BED5264A995616F80A9DED86D3073AC3738CC12CA68
SHA-512:	3B7ACB6256DFB4B7F9599AC555295653E3709D9DF0416C555D694DBCA407113CE3FAA03B7644C47A587CDA095A3BA32CA914EE1B385A01D4DC95EDB0C277E6FC
Malicious:	false
Preview:	MDMP..a..... ......... f............T...............h.......<................<..........`.......8...........T............$..j...........T...........@...............................................................................eJ..............GenuineIntel............T....... ..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78C4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4611
Entropy (8bit):	4.4950722374942265
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VY3Ym8M4JS4FzQ+q8mWpIq3CLd:uIjfzI7ey7V/J9QQv3CLd
MD5:	25BF02646978145CB1125D7D43C4969F
SHA1:	09E56713FAF24CD757B345E49F6B8244191FF414
SHA-256:	89AE71D6E9D58C97880380BE8EAC6D993D887756A01DA1029AD57BAA2451BD3E
SHA-512:	AAD047347A3C5D3FF183BA5E31EE385441CE43D320F62040EF9DD6A82558883D21B5A407654435F0A521334F541ACBEF59A41B8E3FF0768BCD627723D55D1E90
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78E3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.700258046469887
Encrypted:	false
SSDEEP:	192:R6l7wVeJWn6h496Y9zSU9dogmf5XCpBO89bvcsf0esFm:R6lXJO6E6YZSU9dogmf5ivvftD
MD5:	8F2C96919BA0F695821D4EA5572BFEB4
SHA1:	E0A2040A197937A4B57C5FF154D4F3ACA53557A2
SHA-256:	3F6D7577E64A5FA91CB74061C62E640CE6DB2E9A8EC68D0B9E121EA9A8F08B79
SHA-512:	3C6B66D14C536AD0DA5C3F230A0FEBAD785F40F261BAD134EA135730FC1F6FBFCECD4D7BC8D632B9E2DC676F4B56FBAC279D1CD459B9028D5EE54BCCC6555DC9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER798F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4596
Entropy (8bit):	4.4721635416120975
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VYv+Ym8M4Jq4FGR+q8N7WTqcHjd:uIjfzI7ey7VCJC6TcHjd
MD5:	9DC36B55D542C08030EF0B9F27570317
SHA1:	1E497A32D019F295DCC325C1109913BF664DADC0
SHA-256:	7C1A3B8B4E8159BABA43CA79069C630467A344C9B9C204F248B38D6232701322
SHA-512:	1B0788F796F3BD5A4F5EB2106C889329DB3DC0843C4C49CD371E18583FE907CE8B6B20666F66047EBFBA6E6C9FCFF6B1559391A0EDF81355D5239F131A045DA6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B54.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6342
Entropy (8bit):	3.7289384143804742
Encrypted:	false
SSDEEP:	192:R6l7wVeJpuu6PnE9YiXXCpBx89bm+sfwCm:R6lXJB6PneYY7m9fU
MD5:	CD78E987FF07CC8A28F1723C9F5A438F
SHA1:	D8DE1B7D1357310094039438CCFB4F744521FA81
SHA-256:	71ED9885E45DCE057C0A8DD390492EE1DDB4A6AB12A9848F1D539BAD518AF1E5
SHA-512:	557B3B56895B859D9801167287D20F073DF345E320F9F03EDA491C77C516DAD9E3664FBEA4D70ADD014A68F026786FDD1DE79C45CCCEE6BB9FA61E7430EA3141
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B83.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4611
Entropy (8bit):	4.493827193952335
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VYS5Ym8M4JS4FBJr+q8mbUopIq3Cydd:uIjfzI7ey7V6JbJrzv3Cydd
MD5:	1353F6494FB923A20E07D8B9D657AAD7
SHA1:	6A53D72FBAD2A6EB3E49BDCD4ABA6CE09CE534EB
SHA-256:	371D19EF60C323811F194F1F3CA89B93A49DB57F6BAD0F6FE005D1AABEBA454C
SHA-512:	43EE7F31F79D0341B8AAF184F20583831BF516B11B137B1AC212FC051777C14BE80963EB80A655C6245C9A736FAFB10850E98A7355A519599697328FC947A728
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DD3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	76758
Entropy (8bit):	2.1081545991639263
Encrypted:	false
SSDEEP:	384:UYe1wJNTvCBObq9gYsh8o0YjaWKBGOWIaLLGyI:fOwJNTvMcc8oYzJOqvI
MD5:	666D826A814C8A68A8C2B8D9F30A2CA9
SHA1:	D59DA27681907A018798E8449FCEF063F3B33928
SHA-256:	B5C2159959B96217F6E67D6071CBBB7A343D4A51478D76E3D81FD1BC5ACD0A40
SHA-512:	0F10B3118361228612A2A29AED5B5520DF66C1A82220ECB99BCE030EDF7C51A238B392964D16E392A8F0D724EA7EF2724EE937643A9258D5992FC08993AFC1DF
Malicious:	false
Preview:	MDMP..a..... ......... f............T...........D...h.......<................;..........`.......8...........T............#..&.......................................................................................................eJ......l.......GenuineIntel............T.......T..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E60.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	110620
Entropy (8bit):	2.137379130142958
Encrypted:	false
SSDEEP:	768:6f3/WZTvJHBIP3ZJ7h/zf+ltjn+imKvY:6f3aROT1Ktj+imKvY
MD5:	6ED15B634284F92D9C80FD84245E3FC9
SHA1:	693CEDC458DE2494EE1BAD74CB9E6F1209235CA4
SHA-256:	BB6A8C1AA9E786BAA517E8FD158F26D9E8523BC48B9B754AFBECEDF5B62E727D
SHA-512:	5D41BA4A4C6DF410A4BFA7CB5E0CFC5786F2A25253A531EA858BE0FDF36A6FD4E5A5D440C287862DA93B56E4D9FF0D1ADEBFBDD145D7FB85B8E49CCFECAA7181
Malicious:	false
Preview:	MDMP..a..... ......... f....................................<...."......T...vK..........`.......8...........T...........PG...h..........."...........$..............................................................................eJ......x%......GenuineIntel............T.......t..... f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7FB9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6342
Entropy (8bit):	3.7265441943779827
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbRuAl6vYidtFXw8JtgaMOUJ89b9fsfkfm:R6l7wVeJRuo6vYiXXCpBJ89b9fsfkfm
MD5:	69768BE0189CF9A28B933A387A9F6FAC
SHA1:	92CD9A760629924393539E1912482A83CACECC2A
SHA-256:	40F92C5553BDCE59CB8E49F343DC03EE230FC8967AA464B6E68C3538D9398214
SHA-512:	0F471B98E111AB0CFA5498ED5A788157B75D088219A3161CC061B228773D48983E177AD0C61F424BE68615921A6F2C2FE6C102D67A628747CF0CF9A41189F5B9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8102.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4611
Entropy (8bit):	4.496530803210506
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VYwYm8M4JS4FtN+q8mWpIq3CLd:uIjfzI7ey7VQJVQv3CLd
MD5:	04937929B61A69C9CBFB5A005A1BE150
SHA1:	58BFF6810E57ED355EE9BDF27AD8F435E3FB0AB5
SHA-256:	D42A138B3998A4D81CDD11497B84112A84803B8A6C493F4D4E62C02872FA1DF5
SHA-512:	D093714ACC866466BC7C28E222C585B2F1B84EA701C7D5ECAFFD1B69A9E106CE38B61069B51423FBA375514596093F5B8D9FD78365CC7764362645C8BF290DF8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8130.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.7003357547800078
Encrypted:	false
SSDEEP:	192:R6l7wVeJW46QuT6Y9cSU9UZNrGgmf5XCpBl89b9csfQfm:R6lXJR6d6Y2SU9gQgmf5H9vfV
MD5:	853313ACF7DC122F03424DDF749DD359
SHA1:	F9E00DE6CAE2F632D4225FCD2D6EDBB540CE15D1
SHA-256:	AD6EE5E03A6C22A9D867F313ACA6FE3081192E7A1B82D70C48D2AD51ACFD7FF8
SHA-512:	4DCE8E3B758562A119C9C18154C360B2A3B4BF92794A763DEEB51432D4AE5B8B50FA0ADB8B4666A0BF4CF29D262AACE34B0C2C55144612C43B2FA1FAF331F5EE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER815F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4596
Entropy (8bit):	4.47038347316607
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VYq2Ym8M4Jq4FVsi+q8N7WTqcHjd:uIjfzI7ey7Vz/Jci6TcHjd
MD5:	EED20ED340A3C21FE11F6907533A292C
SHA1:	46339D16536B5F4C09F47766A9890A508EA74B13
SHA-256:	D5C4D1B4C4A06EB3230C772E8168DACE5FF83110B30198A01F9E2E8A41643368
SHA-512:	44E2B7122F38ECCE65EF4C9095BD64B5033288AC127825DADE964217C67B6A8D2652C31C0412B0DBA78A2DBFE1B073BF53C29B42B90A963B97AA6612A9A8A594
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8248.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	54686
Entropy (8bit):	2.1959266237437145
Encrypted:	false
SSDEEP:	192:8gFXC7ghu6V9HOiQTvCp8gbCOCKeEsUVPf/+7je+feWS8q3PSTmfQFse3cOPnjRQ:JlhJPuZTvCp8AyEswP+7j/UPqcObi
MD5:	5AD05F44AAD4B7665FD2265A820BE064
SHA1:	65A76DB4C8E692F984E6D1CF4D42DE7D082FD7C4
SHA-256:	3CE4B6E9ADC65CDB97D36187C3BAF273FD3E31C11398162D19B04BAD68AB6643
SHA-512:	CD4DB04CDAF0F748E72BDB0798DFE54C35BB65FA935736CEFAF92FE5FA45798239FA87148D44D2816FC255C1EEDF570C3AFC4630C91FBABC5AD21CFFFB37D2F8
Malicious:	false
Preview:	MDMP..a..... ......... f........................(...........$................/..........`.......8...........T...........@ ..^...........$...........................................................................................eJ..............GenuineIntel............T.......,..... f............................. ..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83FE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8366
Entropy (8bit):	3.7020238864749495
Encrypted:	false
SSDEEP:	192:R6l7wVeJAU6C6Y9OSU9UZNrGgmf6XCpBC89b0QsfHcm:R6lXJj6C6YUSU9gQgmf6e0jfJ
MD5:	715A15483506FBACFEE2F0F388EC8513
SHA1:	8F61782141DCE709134CE3A8A55C19B6E3B1D298
SHA-256:	E7BEC3A21F97B53E4FA93177A23C764495D00FD589069F03817E01E6369DFAF8
SHA-512:	EB3A399D10C7A3B53E7B06F2EBEE0419064B66BC742A49391545D01870CD8C771FE3984CCD6E2DB1C169F3727FEDA1C222E0928D5D5F27809016F6C9CFE53873
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.1.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER84BB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	4.486450955756427
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9YDWpW8VYSYm8M4JE4FD+q8SeOdqD8ed:uIjfzI7ey7VKJfKOkD8ed
MD5:	4428954916FAB73EED7BE634F3FFCD9B
SHA1:	011943980E4FE3C1FED41B21CBE4368162673E93
SHA-256:	E406C1AB385D0EE565409D0D11BB0D432828C04B6FFD13DBCC72C0E22651469B
SHA-512:	E3B0225028AB59E20B465F172E1720ED756C42FD2B19876C0EE4CF87DD2452C80E677226E333CE074DD46281A16D4FA5CA8E65D2AD1F141A3AD2A114A732B8E5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285044" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	909312
Entropy (8bit):	7.543718231589517
Encrypted:	false
SSDEEP:	12288:nrpWNztODIkpIKLFkXLWR4ICfCjDmEtx9YGk5gtB2f1pnYbn+Bnd+WDbLEa:1ZIkqKz4/fa6SId229Gb+z+2LEa
MD5:	446F080CD1ED262B4DD0C1FF2143297E
SHA1:	B958C52622A02D7ED530F6D41A7E7C24A27F7918
SHA-256:	A211901DEA69EAB959B9E47A6276BA7F363B6857687C410ADCAF56135586B7EA
SHA-512:	B176604CB47C789B42DB3119DF7480B5B25C126682CC6AD769D963B1CAB228DA0DB277C1B007365962DA89D62657EE01CD5C153FEC00D2FB1AFE312B9D6488DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:.D.[...[...[....+..[....=..[....:..[.......[...[...[....4..[......[..../..[..Rich.[..........................PE..L...$..d............................A.............@.................................t......................................\|...(.... ......................................................H...........@............................................text...}........................... ..`.rdata..P...........................@..@.data.....~......"..................@....tls................................@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\6XWWeAeVicQTZ7HrJgfaAa9.zip

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5523
Entropy (8bit):	7.895841973301727
Encrypted:	false
SSDEEP:	96:ZWGzqeAoMq+YK0KF8cAJiI2i+u6QkyI3A3Wv/Dh43TS3KJL:tqASpF8wFZQTI3vd43m6JL
MD5:	F291525A2CC01A1FD4636BEC25A58CD4
SHA1:	1EC5AB6F6385531B92685411E37CDF03B5B79928
SHA-256:	C4814E724B8F48B4688C6DD52C9769E427DC3D96BD6A5514A304BAB9DD4AF7CC
SHA-512:	366319B5A520519851A39BEAF61E41DB7B1A2BE1EB08114957E7E4C1D4ED42DB54A92DAA7A27C70ADBF4F1A34BA7AEF765169309138B4164AC99644B1C56B4F6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\6XWWeAeVicQTZ7HrJgfaAa9.zip, Author: Joe Security
Preview:	PK........FM.X................Cookies\..PK........FM.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\7SoGIg_Dgh61RYTHw6zemBp.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	5626
Entropy (8bit):	7.893689001540579
Encrypted:	false
SSDEEP:	96:3UT29vHz9WQBavDziBP1Pe4McobRHSINuVRtR+QlLiCDF5qTypr3KJ1:3UT29Hz9WGFh1Pe4q4DA+F5R6J1
MD5:	75EC89F83C64778CBFC0F9185ED9D848
SHA1:	DF3827538B1F3F5B8849B3C70E3E789045E922DD
SHA-256:	5959B64D804540E52C28652AD8211A5DA4FB7464BC42D10504346A3587EF85EB
SHA-512:	41B3AB4F000A915E74FF2FDEBFDAED8F051DCBAB50ED5F6C1D87F728E2283948FA14BCFE68AE968C631736045A9882EBDEDC349B9FEF34D9E914A39CD7773086
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\7SoGIg_Dgh61RYTHw6zemBp.zip, Author: Joe Security
Preview:	PK........EM.X................Cookies\..PK........EM.X..s@..../......Cookies\Chrome_Default.txt.G.....5..G.BMx.....%.M...{...?.LH..71.t.....:y3..s./.0.m.%......../. ..!..A.C.........;...x...........!.2.....Z..<....<.h8..<.q;.....9....gK.}.R.#f...A.E...1...?lR....b.....nS=l.%E&'...>x......h.......E)C..t..'.2<Z_@.........&Lk......0..B.mqk.9M1lf.-e@....E.v..R&..\|..-....C.w.Y.K... ........k..3..2W5.!vs.....S.~.......0._.*..e.....U...).....>...g+;...z[Ks....Z..d...\|.".v..(...I....+.7.y.X@.H....eV.............Y..c..x...Kw.'S>.d\|.....B..k.p..\|C\|F.......O52....`f.3W..../....i..E...7..c.Kwv..,]..C..j.2.T..+............t.2....6.M>..s..K.M...VJ..>;.......n.<f;]s.K..5...n....~$ ....%......Z#.....Q5...<n...I&......0<:..>..I.K)g.)..KX.H.(Y!..j4W.j..1.V..d\.T..,p...D...T..>z...,.....L.....Mh.t..!....A...!?.U...x..[a7j.N;#..t.\.#.Z.-)f...v_.<..?..`.D0..?......).vX.#...Lw.j...1.....M.#...+.W....h....U.W....G.w......'.Y?.....;.....`...X...C..w..

C:\Users\user\AppData\Local\Temp\adobe6Qz8rFkBJKgG\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobe6Qz8rFkBJKgG\information.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6043
Entropy (8bit):	5.421697465850321
Encrypted:	false
SSDEEP:	96:x7B19mZRKkcT4Aisph+9hcB3Tp0vcxs9/FqR7+kAANUbg3x:xkIkvAtphWhcB3Tp00McPhB
MD5:	11BADC527507E1095F58BAB2DF4B3429
SHA1:	16AE1E5E92D792964A04DFB73D2F0A44F62DF6C7
SHA-256:	D56A24DDCABEE6F3840B8A03B8D83EBE42590DBBBE0C2DA55FE1C4039DB41075
SHA-512:	0CA5A32948E1F624DC09A76ABFE7F6B0FF7E1FAF58333376C13202167CA02505DAC852E1D2442786640AC015CF586F339A7FDDB8369E753458D3F9E039E24F6B
Malicious:	false
Preview:	Build: zorka..Version: 1.9....Date: Thu Apr 18 09:42:00 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 753c4c2d8deab6dd7e693b7cc1ab050b....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobe6Qz8rFkBJKgG....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 061544 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 18/4/2024 9:42:0..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrv

C:\Users\user\AppData\Local\Temp\adobe6Qz8rFkBJKgG\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobeMPBzMuKRxBXT\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	12170
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	192:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WhHGYUnOTNC5IcXkWFXZQHRFJ5Pts7c3aP:gwsPbtKvCpqq40wsPbtKvCpqq47
MD5:	B6F52D24FC4333CE4C66DDA3C3735C85
SHA1:	5B69F1D66E95EFE2CF1710E9F58526B2AAEC67E4
SHA-256:	0FEE1A764F541EC6733DB89C823296650F6E581CD7D812D5A142B5A0AD9BC9B6
SHA-512:	CD2C6D64083061D7C7A7E89CF9C9F7D2B66301C73CFB56D2CCD94D1B810DE42774DAE5B77DB2E567A26FC54989C04D8A60D76225E6F3F91FCD2AE4D2E01F3C4C
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobeMPBzMuKRxBXT\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5862
Entropy (8bit):	5.415370469623048
Encrypted:	false
SSDEEP:	96:x7Bx9mZRKIcT4Aisph+9hcB3Tp0vcxs9/FqRTANUbg3x:x4IIvAtphWhcB3Tp00MjB
MD5:	B6021223E3C95EDEC8CD781F6D9714BC
SHA1:	D104D0FC8894609561917F71D249F006E1899D4E
SHA-256:	DF06EFBC411B62260D241C174012A78FE3BAC34A92AE1253070E302BC9F74A28
SHA-512:	9D3ABBD44B1812B07732A5D3AA3BDE35024F7AE8A551D586B868AA40704F7B9FAFF4870677BABD361E5CEED5DEB10AAB6BF88434EA59CF0B52FE4DE16FB5DE8F
Malicious:	false
Preview:	Build: zorka..Version: 1.9....Date: Thu Apr 18 09:41:56 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 753c4c2d8deab6dd7e693b7cc1ab050b....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobeMPBzMuKRxBXT....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 061544 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 18/4/2024 9:41:56..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784].

C:\Users\user\AppData\Local\Temp\adobeMPBzMuKRxBXT\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobe_DCXbajIrPwg\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobe_DCXbajIrPwg\information.txt

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5754
Entropy (8bit):	5.4105680924592985
Encrypted:	false
SSDEEP:	96:x7BU95ZRKZcT4Aisph+9hcB3Tp0vcxs9/FqRJANUbg3x:xAIZvAtphWhcB3Tp00MZB
MD5:	030D58C8BB3650BA4685BC7A6510EC7C
SHA1:	96502D40226E19E717FCFEF0C4E2B3F316A01303
SHA-256:	493BDF1652531590BCBD72180458864C5C68C9C2EF63F4B20477DE00181F6DAF
SHA-512:	1C394B2FED2E7AFF9A5E138AF8AED87729B9E0E72DA6A982F4E68501C3B3314A2AEEC1050A02CE4F61E19136495A56C0D30DF54891CDD82407EC31125C6D5D4A
Malicious:	false
Preview:	Build: zorka..Version: 1.9....Date: Thu Apr 18 09:41:53 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 753c4c2d8deab6dd7e693b7cc1ab050b....Path: C:\Users\user\Desktop\dendy.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobe_DCXbajIrPwg....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 061544 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 18/4/2024 9:41:53..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784]..svc

C:\Users\user\AppData\Local\Temp\adobe_DCXbajIrPwg\passwords.txt

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c9bTQaLpRNBVsUoe4pkuQMW.zip

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5583
Entropy (8bit):	7.89873043026967
Encrypted:	false
SSDEEP:	96:ZWGzqeAoMq+YK0KF8cAJiI2i+uwEMxfTUUnAq5tGyTnX63KJd:tqASpF8wFR5Aq5EmX66Jd
MD5:	D2C2BF6C23C7FFABCA7E2CA120E25F7C
SHA1:	4EE5F3B723AB985465D729F234F8F0A0462470E9
SHA-256:	703C615BC938C8A22F79916B1612B9D8A0BB1CF7EED56B5D74D7BB8E5CED0828
SHA-512:	C108E1F047D061C5679DD576F83D0CB0002C491D895C4BA0BA4C42B3781CF7A5238E502157819DB2B0390E76022B5C6B42D269A26FDF9C16E88025EB615A89AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\c9bTQaLpRNBVsUoe4pkuQMW.zip, Author: Joe Security
Preview:	PK........FM.X................Cookies\..PK........FM.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\0SUQ0f15JMK7Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\6xQrR_hJnX90Login Data For Account

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\GrE_iBTQJdDJHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\LWKdqyAhSnWPLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\NuTl_5zQHhB1Web Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\VIFFOsfry3qSHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\XEPXj5v8mkStCookies

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\YXdO0FNFZMXPWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\fd7hv5c9m7PWLogin Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\hCv8TVXXESZkHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\pbkJaPMaY9JtWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\xLkPmPbriQeYHistory

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\xjqD6LmmUXwRWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\zYbZR7DAArvUWeb Data

Download File

Process:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\2l02O9W1_FhwWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\4hARhjpljgnYHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\4yZUYxDepIZ1Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\7QP8D56XEcyNHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\BAKulPcBRmujHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\BYnglavidnY6Login Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\FDWjNP4RsRAAWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\Lx2g_U4O1ewNWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\fNgu77Rnk80sHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\fXJWNy96hYVoWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\hd0ZRJK8jbpUCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\lt1lRsmiPxELLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\o47QYaSXnflcWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\s5KTHH5Pma1BLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\9kIPQpaY4rvVHistory

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\BpKPZ1MEPGssHistory

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\Ct9hyqWswfwmWeb Data

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\E3k9iNbkN2AxHistory

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\Jny1sItdcq9uWeb Data

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\Qmh61QEwQYiXCookies

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\UilUp13UfaxJWeb Data

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\cMZR3uGrcVjNLogin Data

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\fHH8Sj5XFtveWeb Data

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\hn0rI1Di9iTsHistory

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\jivh3ZMPe0AVWeb Data

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\nF96X0gSy0TrLogin Data

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\q4newEXeW0gGLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\wUqBSbUei7PhWeb Data

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\dendy.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.873140679513133
Encrypted:	false
SSDEEP:	3:L4j:Uj
MD5:	4BB20CDD572B0F010D78159C6C529EE5
SHA1:	0312B66A8AE6906B9FFE7A7C804A9768775143B3
SHA-256:	9F19163BE044F9F285699D7F81328E54AD47D8E60BA1077C70E46C954A70A6C1
SHA-512:	5460FBC00650E527561F7B09179174218652336E9A94F7E0A1DFFDFD4598F6756567B2B8F68B2579F84EF0A19BD71144624A57569956CA2352BDA12641272DF2
Malicious:	false
Preview:	1713430120825

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468164197413436
Encrypted:	false
SSDEEP:	6144:BIXfpi67eLPU9skLmb0b4hWSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSbe:CXD94hWlLZMM6YFHO+e
MD5:	5468F83FEB6EC2530FF0832F5D5CBFA1
SHA1:	EA9EDDFED10F339E050A6E684C3F1A06CAFAE2B3
SHA-256:	EEFD97F771688FC576E0F3E83B224D20279A062DAB11BDBB67F8E98E1E12E7AA
SHA-512:	91DCB48F964EBCC2112F190B3014DECF8AF2D34AA90AF93281D8FAB764914795B01727BAEF108A8A9A5C9C006648234B378EF4D0076FDFFEC3B3F9B1A281E5FA
Malicious:	false
Preview:	regf=...=....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmB...c..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.543718231589517
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dendy.exe
File size:	909'312 bytes
MD5:	446f080cd1ed262b4dd0c1ff2143297e
SHA1:	b958c52622a02d7ed530f6d41a7e7c24a27f7918
SHA256:	a211901dea69eab959b9e47a6276ba7f363b6857687c410adcaf56135586b7ea
SHA512:	b176604cb47c789b42db3119df7480b5b25c126682cc6ad769d963b1cab228da0db277c1b007365962da89d62657ee01cd5c153fec00d2fb1afe312b9d6488de
SSDEEP:	12288:nrpWNztODIkpIKLFkXLWR4ICfCjDmEtx9YGk5gtB2f1pnYbn+Bnd+WDbLEa:1ZIkqKz4/fa6SId229Gb+z+2LEa
TLSH:	D01512213A90E173F94E4473BA1AC6743E7AF8A597685527770C2E7F2B302E1562433B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:.D.[...[...[....+..[....=..[....:..[.......[...[...[....4..[....*..[..../..[..Rich.[..........................PE..L...$..d...

File Icon


Icon Hash:	13295d4d29170f17

Static PE Info

General

Entrypoint:	0x401941
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6419D024 [Tue Mar 21 15:41:24 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	14ef0fc1d4be9b1c7ae01c60ea12a8bd

Entrypoint Preview

Instruction
call 00007F9B0983F245h
jmp 00007F9B0983A9CEh
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F9B0983AB76h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F9B0983ABA0h
test ecx, 00000003h
jne 00007F9B0983AB41h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F9B0983AB3Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F9B0983AB84h
test ah, ah
je 00007F9B0983AB76h
test eax, 00FF0000h
je 00007F9B0983AB65h
test eax, FF000000h
je 00007F9B0983AB54h
jmp 00007F9B0983AB1Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040F22Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F9B0983AB5Eh
test byte ptr [eax], 00000008h
je 00007F9B0983AB59h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcde7c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28b2000	0xdfa8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xcd748	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xcd700	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd67d	0xd800	bc14a58614d469bd1c271ba019301f23	False	0.6057038483796297	data	6.664734708351165	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0xbf750	0xbf800	7a1c74f788504b9ea4a0ff81ae73e0ab	False	0.9010242432278068	data	7.6657726486145386	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcf000	0x27e16f4	0x2200	3c4b3de1a8674a7b889999d1f72d427f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x28b1000	0x9cd	0xa00	b85f229e4962d23b2bc27d3fefa72e8e	False	0.010546875	data	0.004986070829181356	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x28b2000	0xdfa8	0xe000	cceac1bfd4049c2fe473c534974561bf	False	0.5247453962053571	data	5.416254851646741	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x28b24c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.42510660980810233
RT_ICON	0x28b3368	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5496389891696751
RT_ICON	0x28b3c10	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.619815668202765
RT_ICON	0x28b42d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6950867052023122
RT_ICON	0x28b4840	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.5345435684647303
RT_ICON	0x28b6de8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.5562851782363978
RT_ICON	0x28b7e90	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.634016393442623
RT_ICON	0x28b8818	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.6631205673758865
RT_ICON	0x28b8cf8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.3816631130063966
RT_ICON	0x28b9ba0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5166967509025271
RT_ICON	0x28ba448	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.5817972350230415
RT_ICON	0x28bab10	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6322254335260116
RT_ICON	0x28bb078	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.5081950207468879
RT_ICON	0x28bd620	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.5030487804878049
RT_ICON	0x28be6c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5032786885245901
RT_ICON	0x28bf050	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.5212765957446809
RT_STRING	0x28bf710	0x76	data			0.652542372881356
RT_STRING	0x28bf788	0x64c	data			0.43300248138957814
RT_STRING	0x28bfdd8	0x84	data			0.6287878787878788
RT_STRING	0x28bfe60	0x142	data			0.531055900621118
RT_GROUP_ICON	0x28b8c80	0x76	data	Turkish	Turkey	0.6610169491525424
RT_GROUP_ICON	0x28bf4b8	0x76	data	Turkish	Turkey	0.6694915254237288
RT_VERSION	0x28bf530	0x1e0	data			0.56875

Imports

DLL

Import

KERNEL32.dll

GetDateFormatW, GetConsoleAliasesLengthW, EnumCalendarInfoW, SetDefaultCommConfigW, SetFirmwareEnvironmentVariableA, GetComputerNameW, UnlockFile, GetModuleHandleW, CreateNamedPipeW, GetProcessHeap, FindNextVolumeMountPointA, EnumTimeFormatsW, SetCommState, GlobalAlloc, LoadLibraryW, GetLocaleInfoW, IsBadWritePtr, GetAtomNameW, SetConsoleTitleA, GetCurrentDirectoryW, GetLongPathNameW, GetProcAddress, BuildCommDCBW, LoadLibraryA, SetConsoleDisplayMode, SetCurrentDirectoryW, GetModuleFileNameA, FreeEnvironmentStringsW, BuildCommDCBA, VirtualProtect, SetCalendarInfoA, FindAtomW, FileTimeToLocalFileTime, HeapAlloc, Sleep, ExitProcess, GetStartupInfoW, RaiseException, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetLastError, HeapFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, WriteFile, GetStdHandle, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, InitializeCriticalSectionAndSpinCount, GetModuleFileNameW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, GetLocaleInfoA, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, CreateFileA, CloseHandle, FlushFileBuffers, GetModuleHandleA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/18/24-09:41:54.899031	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49731	58709	192.168.2.4	147.45.47.93
04/18/24-09:41:16.817956	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49730	147.45.47.93	192.168.2.4
04/18/24-09:41:09.663282	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49730	147.45.47.93	192.168.2.4
04/18/24-09:41:53.335082	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49730	58709	192.168.2.4	147.45.47.93
04/18/24-09:42:13.250995	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49746	58709	192.168.2.4	147.45.47.93
04/18/24-09:41:09.471690	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49730	58709	192.168.2.4	147.45.47.93
04/18/24-09:42:02.523877	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49739	58709	192.168.2.4	147.45.47.93
04/18/24-09:41:13.824615	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49732	147.45.47.93	192.168.2.4
04/18/24-09:41:13.499765	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49731	147.45.47.93	192.168.2.4
04/18/24-09:41:43.723664	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49739	147.45.47.93	192.168.2.4
04/18/24-09:41:19.788174	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49731	147.45.47.93	192.168.2.4
04/18/24-09:41:19.803148	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49732	147.45.47.93	192.168.2.4
04/18/24-09:41:29.078780	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49739	147.45.47.93	192.168.2.4
04/18/24-09:41:54.901092	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49732	58709	192.168.2.4	147.45.47.93
04/18/24-09:41:36.448653	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49746	147.45.47.93	192.168.2.4
04/18/24-09:41:43.865022	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49746	147.45.47.93	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 09:41:09.219270945 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:09.441447973 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:09.441555023 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:09.471689939 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:09.663281918 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:09.705679893 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:09.743331909 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:12.783957005 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:13.056051016 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:13.062457085 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:13.281060934 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:13.281147003 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:13.294459105 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:13.387106895 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:13.499764919 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:13.549362898 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:13.556041002 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:13.605653048 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:13.605736971 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:13.619801044 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:13.824615002 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:13.877501965 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:13.883897066 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:16.612332106 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:16.817955971 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:16.861932993 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:16.883999109 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:16.971369028 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:17.243277073 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:19.699807882 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:19.752485991 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:19.788173914 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:19.803148031 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:19.830720901 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:19.846282959 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:23.657541037 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:23.657639027 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:23.657711029 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:23.669825077 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:23.669868946 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:23.896933079 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:23.897006035 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:23.903300047 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:23.903310061 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:23.903590918 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:23.949531078 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:25.839278936 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:25.884109974 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:25.970999956 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:25.971323967 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:25.971384048 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:25.974021912 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:25.974021912 CEST	49733	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:25.974044085 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:25.974056959 CEST	443	49733	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:26.089104891 CEST	49735	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:26.089149952 CEST	443	49735	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:26.089258909 CEST	49735	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:26.089586973 CEST	49735	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:26.089602947 CEST	443	49735	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:26.313915968 CEST	443	49735	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:26.314049006 CEST	49735	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:28.088051081 CEST	49735	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:28.088073969 CEST	443	49735	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:28.089159966 CEST	443	49735	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:28.090668917 CEST	49735	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:28.132167101 CEST	443	49735	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:28.318603039 CEST	443	49735	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:28.318852901 CEST	443	49735	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:28.319000959 CEST	49735	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:28.319000959 CEST	49735	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:28.319067955 CEST	49735	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:28.319087982 CEST	443	49735	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:28.319422007 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:28.588191986 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:28.639808893 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:28.648267984 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.648308039 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:28.648477077 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.649821043 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.649842978 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:28.707552910 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.707626104 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:28.707700968 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.709254026 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.709287882 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:28.859363079 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:28.859443903 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:28.871474981 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:28.873739958 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:28.873837948 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.875327110 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.875349045 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:28.876151085 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:28.931355953 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:28.935452938 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.937553883 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:28.937577009 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:28.937939882 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.010763884 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.049350023 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.078779936 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:29.134038925 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:29.236896038 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:29.637052059 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.654097080 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.680128098 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.700119019 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.767935038 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.768115997 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.768208027 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.768718004 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.768753052 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.768771887 CEST	49741	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.768781900 CEST	443	49741	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.770530939 CEST	49743	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:29.770586014 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:29.770735025 CEST	49743	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:29.771043062 CEST	49743	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:29.771054983 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:29.789027929 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.789145947 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.789271116 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.789748907 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.789748907 CEST	49740	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:29.789769888 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.789782047 CEST	443	49740	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:29.791405916 CEST	49744	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:29.791439056 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:29.791662931 CEST	49744	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:29.791968107 CEST	49744	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:29.791979074 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:29.990669012 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:29.990787029 CEST	49743	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:29.992178917 CEST	49743	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:29.992192984 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:29.992531061 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:29.993812084 CEST	49743	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.008079052 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.008171082 CEST	49744	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.040122986 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.172213078 CEST	49744	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.172236919 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.172749043 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.174452066 CEST	49744	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.216133118 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.360583067 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.360701084 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.360816956 CEST	49743	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.360999107 CEST	49743	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.361015081 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.361026049 CEST	49743	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.361030102 CEST	443	49743	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.361476898 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:30.378572941 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.378655910 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.378789902 CEST	49744	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.379048109 CEST	49744	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.379059076 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.379067898 CEST	49744	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:30.379071951 CEST	443	49744	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:30.379535913 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:30.633953094 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:30.649519920 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:32.208614111 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:32.477639914 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:36.004522085 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:36.226365089 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:36.226718903 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:36.238707066 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:36.448652983 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:36.501100063 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:36.509046078 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:38.557358980 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:38.611874104 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:38.612376928 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:38.635209084 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:38.650902987 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:38.690071106 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:38.705734015 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:38.884219885 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:39.565082073 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:39.837105989 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:43.138089895 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:43.190202951 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:43.206057072 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:43.259923935 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:43.293567896 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:43.315018892 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:43.315664053 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:43.315824986 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:43.477447987 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:43.586802006 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:43.586853981 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:43.723664045 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:43.768116951 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:43.865021944 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:43.908718109 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.563388109 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563452959 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563507080 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563546896 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563545942 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.563587904 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563628912 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563633919 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.563656092 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.563668013 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563676119 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.563709021 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563747883 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563760042 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.563790083 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.563842058 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.606719017 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.622981071 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.627785921 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.627829075 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.785384893 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.785475016 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.785497904 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.785518885 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.785542011 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.785665035 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.846328974 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:44.899624109 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:44.899662971 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:45.118186951 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:45.463689089 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:45.518073082 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:45.588203907 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:45.643073082 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:45.981496096 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:45.981538057 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:45.981594086 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:45.982846022 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:45.982862949 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:46.106142044 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.106208086 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:46.106374025 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.107140064 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.107176065 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:46.201374054 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:46.201456070 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.205080986 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.205090046 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:46.205303907 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:46.252598047 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.328186989 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:46.328361034 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.329637051 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.329660892 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:46.330034018 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:46.377471924 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.607012033 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624418020 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624473095 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624511003 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624531031 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.624550104 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624588013 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624625921 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624628067 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.624666929 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624703884 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624715090 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.624742985 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624748945 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.624783039 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.624850988 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.639810085 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.639848948 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.639884949 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.639921904 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.639919996 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.639960051 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.639971972 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.639998913 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.640034914 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.640072107 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.640085936 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.640125990 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.640141964 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.640178919 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.640369892 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.658714056 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.705955029 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.843544006 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.843609095 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.843647957 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.843691111 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.843704939 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.843733072 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.843736887 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.858755112 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.858854055 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.858892918 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.858932018 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.858935118 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.858968973 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:46.859014034 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.893064976 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.908698082 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.924572945 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.924747944 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:46.967482090 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:46.977634907 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:47.012159109 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.075504065 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:47.102787018 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.103120089 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.103188038 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:47.103380919 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:47.103380919 CEST	49747	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:47.103401899 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.103413105 CEST	443	49747	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.105026007 CEST	49749	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.105084896 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.105182886 CEST	49749	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.105487108 CEST	49749	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.105520010 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.120121002 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.198421001 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:47.198472977 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:47.211323023 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.211714029 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.211780071 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:47.211991072 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:47.211991072 CEST	49748	443	192.168.2.4	34.117.186.192
Apr 18, 2024 09:41:47.212018967 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.212043047 CEST	443	49748	34.117.186.192	192.168.2.4
Apr 18, 2024 09:41:47.213541985 CEST	49750	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.213577986 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.213886023 CEST	49750	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.214171886 CEST	49750	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.214189053 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.329799891 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.329917908 CEST	49749	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.437901974 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.437995911 CEST	49750	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.439320087 CEST	49750	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.439327002 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.439806938 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.441076040 CEST	49750	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.484160900 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.541189909 CEST	49749	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.541266918 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.542196989 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.543637991 CEST	49749	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.555515051 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:47.555680037 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:47.584155083 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.696388960 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:47.696564913 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:47.719644070 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.719749928 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.720052004 CEST	49749	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.720156908 CEST	49749	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.720156908 CEST	49749	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.720197916 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.720230103 CEST	443	49749	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.753813982 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.754062891 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.754128933 CEST	49750	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.754213095 CEST	49750	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.754225016 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.754240036 CEST	49750	443	192.168.2.4	104.26.5.15
Apr 18, 2024 09:41:47.754245996 CEST	443	49750	104.26.5.15	192.168.2.4
Apr 18, 2024 09:41:47.821300030 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:47.821547985 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:47.962033987 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:47.962110043 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:48.086822987 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:48.227768898 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:48.856168985 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:48.905724049 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:48.908833981 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:48.920257092 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:48.971204042 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:49.002686024 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:49.002904892 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:49.274708986 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:49.274806976 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:49.962055922 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:49.962471008 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:49.966049910 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:49.982515097 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:50.033726931 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:50.111809969 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:50.139332056 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:50.144191027 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:50.227612972 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:50.244450092 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:50.286468029 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:50.418179035 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:50.558193922 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:51.634536982 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:51.634567976 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:51.634773016 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:51.635014057 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:51.857758045 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:51.899924994 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:51.899969101 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:51.941457987 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:51.997431993 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:52.051218033 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:52.212002993 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:52.321542978 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.264872074 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.264902115 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.264919996 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.264939070 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.264960051 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.264978886 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.264997959 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.265016079 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.265033960 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.265057087 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.265093088 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.265093088 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.265093088 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.265121937 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.298194885 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298319101 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298340082 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298358917 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298377991 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298388958 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.298398018 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298419952 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298439026 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298459053 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298466921 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.298466921 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.298477888 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.298496008 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.298530102 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.335082054 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.484369040 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.484402895 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.484422922 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.484442949 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.484462976 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.484555006 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.484555006 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.520673037 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.520706892 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.520726919 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.520745039 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.520766020 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.520765066 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.520843029 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.533886909 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.533900023 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.602926970 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.684086084 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.806231976 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.806262970 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.830566883 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.887811899 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:53.893656015 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:53.935204029 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:54.002492905 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:54.023577929 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:54.165574074 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:54.231540918 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:54.262676954 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:54.315011024 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:54.315092087 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:54.899030924 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:54.901092052 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:55.165556908 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:55.165586948 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:55.416296005 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:55.431767941 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:41:55.518269062 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:41:55.611809015 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:02.523876905 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:02.790138006 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:02.806894064 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:03.002434969 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:05.650942087 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:05.651101112 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:05.869456053 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:05.869488001 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:05.869507074 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:05.869585037 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:06.133858919 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:08.705673933 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:08.924242973 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:12.844433069 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:12.844584942 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:13.064341068 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:13.064404964 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:13.064564943 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:13.250994921 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:13.336772919 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:13.377681017 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:13.377778053 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:13.524643898 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:13.599229097 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:13.599253893 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:13.599266052 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:13.599292040 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:13.868174076 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:14.231754065 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:14.231831074 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:14.450454950 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:14.450486898 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:14.450501919 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:14.450515985 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:14.698012114 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:14.698090076 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:14.712178946 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:14.919727087 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:14.919756889 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:14.919815063 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:14.919866085 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:15.196435928 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:15.893115997 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:16.111677885 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:16.442006111 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:16.663762093 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:17.268402100 CEST	49739	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:17.486999989 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:17.705811977 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:17.927512884 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:24.681857109 CEST	58709	49746	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:24.681956053 CEST	49746	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:45.212374926 CEST	58709	49731	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:45.212461948 CEST	49731	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:51.977555037 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:51.977585077 CEST	58709	49732	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:51.977775097 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:51.977792025 CEST	49732	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 09:42:53.743108034 CEST	58709	49739	147.45.47.93	192.168.2.4
Apr 18, 2024 09:42:53.743336916 CEST	49739	58709	192.168.2.4	147.45.47.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 09:41:23.515213013 CEST	49468	53	192.168.2.4	1.1.1.1
Apr 18, 2024 09:41:23.620235920 CEST	53	49468	1.1.1.1	192.168.2.4
Apr 18, 2024 09:41:25.982060909 CEST	54966	53	192.168.2.4	1.1.1.1
Apr 18, 2024 09:41:26.088136911 CEST	53	54966	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 09:41:23.515213013 CEST	192.168.2.4	1.1.1.1	0x5889	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:41:25.982060909 CEST	192.168.2.4	1.1.1.1	0x9d85	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 09:41:23.620235920 CEST	1.1.1.1	192.168.2.4	0x5889	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:41:26.088136911 CEST	1.1.1.1	192.168.2.4	0x9d85	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:41:26.088136911 CEST	1.1.1.1	192.168.2.4	0x9d85	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:41:26.088136911 CEST	1.1.1.1	192.168.2.4	0x9d85	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	34.117.186.192	443	7028	C:\Users\user\Desktop\dendy.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:25 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 07:41:25 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 07:41:25 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 07:41:25 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 07:41:25 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	104.26.5.15	443	7028	C:\Users\user\Desktop\dendy.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:28 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 07:41:28 UTC	652	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 07:41:28 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471628:2740_93878F2E:0050_6620CEA8_8A2111E:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lengErSF2xqO5o8C3qllkMfzicW2ueOlUdUnE5hBBpMWIha3N8o3FhLwQoXzuBn8SaZrwfaB9XgbygeSobr8klNXa9PKmhcE0DpZ3cx%2Bm1R%2FiLPjganN0l5Tlw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8763033aec2cb0ed-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 07:41:28 UTC	699	IN	Data Raw: 32 62 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a Data Ascii: 2b4{"status":"ok","demoInfo":{"ipAddress":"81.181.57.52","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":
2024-04-18 07:41:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	34.117.186.192	443	6996	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:29 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 07:41:29 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 07:41:29 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 07:41:29 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 07:41:29 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	34.117.186.192	443	6688	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:29 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 07:41:29 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 07:41:29 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 07:41:29 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 07:41:29 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	104.26.5.15	443	6996	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:29 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 07:41:30 UTC	656	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 07:41:30 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471E72:2E58_93878F2E:0050_6620CEAA_8A2115C:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bPHgcabrtfLpcW2VR%2BUo8l1219Kg6cvZdwDU9K%2FxAiHEdOlR7dur0ECGpvOBXyKPKyvrSSO2G6XUPJAQnHqhXVmif7rvcnO7U2knB6JnY0K6vCI%2B1MBZ8boU%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87630347ae6553e5-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 07:41:30 UTC	699	IN	Data Raw: 32 62 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a Data Ascii: 2b4{"status":"ok","demoInfo":{"ipAddress":"81.181.57.52","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":
2024-04-18 07:41:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	104.26.5.15	443	6688	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:30 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 07:41:30 UTC	656	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 07:41:30 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454653:516A_93878F2E:0050_6620CEAA_89F4498:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wGZJJhdEK7MACRv5GemiFIswf6%2BI5D3yJtyAS7TantmutIJ0YCKYNqBgeQJ0VGSk0R1Qyah5yT52HjBhbtOM7Tl0oHlP2p%2F8gRScU%2BVNHfo2oUG2ryP28%2FZr1g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87630347ed386775-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 07:41:30 UTC	699	IN	Data Raw: 32 62 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a Data Ascii: 2b4{"status":"ok","demoInfo":{"ipAddress":"81.181.57.52","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":
2024-04-18 07:41:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	34.117.186.192	443	5164	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:46 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 07:41:47 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 07:41:47 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 07:41:47 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 07:41:47 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49748	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:47 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 07:41:47 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 07:41:47 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 07:41:47 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 07:41:47 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49750	104.26.5.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:47 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 07:41:47 UTC	658	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 07:41:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4547D7:D07E_93878F2E:0050_6620CEBB_89F4667:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9gWL6BGmcyohstKpV3KEWuf7Sq%2FK4gp0iulFgz9dQjY%2BRHoIqz4oGExKo%2F%2BM7UKC8O5AQsaCKXiTKWwBOK2idjbAlDllcsD29rkp24ytMky2S0zAsnswudQU%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876303b4ac7a6730-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 07:41:47 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 07:41:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	104.26.5.15	443	5164	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:41:47 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 07:41:47 UTC	658	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 07:41:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454745:A5AC_93878F2E:0050_6620CEBB_8A21337:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YXZNWA1jfKczmYlttbdGmePrznOwNc%2BnXfv%2FDONnsiOh6ze%2BUVIz3hyK01UGetER4TLF%2BRVndsmOk5XlOvV%2FWYxkdNRgRrgvLEVyKJDUUV1p0vgnwG9msLznCw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 876303b47fac674c-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 07:41:47 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 07:41:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:41:05
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\dendy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\dendy.exe"
Imagebase:	0x400000
File size:	909'312 bytes
MD5 hash:	446F080CD1ED262B4DD0C1FF2143297E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2501929485.0000000007984000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2500954846.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2415493241.0000000007984000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2415846117.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2502097335.000000000799A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2415760901.0000000007999000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.2415493241.0000000007995000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2501230299.000000000300C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2501387878.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000003.1719048251.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:41:07
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xe50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:41:07
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:41:07
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xe50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:41:07
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:41:07
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 868
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:41:08
Start date:	18/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	909'312 bytes
MD5 hash:	446F080CD1ED262B4DD0C1FF2143297E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2510972800.0000000007981000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2508449882.0000000002E39000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.2510035968.0000000004A60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2508595887.0000000002F92000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.1754038237.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2506460203.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 71%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:41:08
Start date:	18/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	909'312 bytes
MD5 hash:	446F080CD1ED262B4DD0C1FF2143297E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2342275444.0000000002EF2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2343911888.00000000077F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2343201454.0000000002F6D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2340303087.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000003.1754837586.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.2343384935.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:41:11
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 804
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:41:11
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 780
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:41:16
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 952
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:41:17
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:41:18
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:41:19
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:41:20
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 928
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:41:20
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 892
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:41:21
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	909'312 bytes
MD5 hash:	446F080CD1ED262B4DD0C1FF2143297E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000002.2495191919.000000000305E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001A.00000002.2495000425.0000000002DAA000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000002.2495191919.000000000312B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000002.2496030568.0000000007920000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001A.00000002.2495613605.0000000004A40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000002.2493907103.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001A.00000003.1896337586.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 83%, ReversingLabs Detection: 71%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:41:23
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 1464
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:41:23
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 924
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:41:23
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 964
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:41:25
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 884
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	09:41:25
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 1472
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	09:41:25
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 820
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	44.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	99

Executed Functions

Function 0045EA9C Relevance: 133.9, APIs: 39, Strings: 36, Instructions: 2609threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 0045EB04
GetLastError.KERNEL32 ref: 0045EB19
Sleep.KERNEL32(00000529), ref: 0045EB3A
Sleep.KERNEL32(0000002F), ref: 0045EBAA
shutdown.WS2_32(00000002), ref: 0045EBDA
closesocket.WS2_32 ref: 0045EBE6
WSACleanup.WS2_32 ref: 0045EBEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045ECA1
Sleep.KERNELBASE(00000065), ref: 0045EE48
Sleep.KERNEL32(00000000,?,?), ref: 0045EEFF
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 0045F20A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0045F212
GetCurrentProcess.KERNEL32(00000000), ref: 0045F220
OutputDebugStringA.KERNELBASE(#@#^@#TGRERTERYERY,?,?,00000018,0000000A,Function_00002990,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045F234
OutputDebugStringA.KERNELBASE(ewetwertyer eytdryrtdy,00000000,00000000), ref: 0045F2F5
OutputDebugStringA.KERNEL32(td ydrthrhfty,00000000), ref: 0045F4D0
OutputDebugStringA.KERNELBASE(45 hgfch rtdyt gfch,0051D9CA,?,?), ref: 0045FEA5
CreateThread.KERNELBASE(00000000,00000000,00450430,00000000,00000000,00000000), ref: 0045FED0
CreateThread.KERNELBASE(00000000,00000000,00455FC0,00000000,00000000,00000000), ref: 0045FEE6
WaitForSingleObject.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,0051DAE8,00000001,?,?), ref: 0046008D
CreateThread.KERNELBASE(00000000,00000000,Function_000564A0,00000000,00000000,00000000), ref: 00460280
CreateThread.KERNELBASE(00000000,00000000,Function_00058520,00000000,00000000,00000000), ref: 00460294
CreateThread.KERNELBASE(00000000,00000000,Function_0005A490,00000000,00000000,00000000), ref: 004602AB
CreateThread.KERNELBASE(00000000,00000000,Function_0005B4B0,00000000,00000000,00000000), ref: 004602C2
CreateThread.KERNELBASE(00000000,00000000,Function_0005CAE0,00000000,00000000,00000000), ref: 004602D9
CreateThread.KERNELBASE(00000000,00000000,Function_0005CC40,00000000,00000000,00000000), ref: 004602ED
CreateThread.KERNELBASE(00000000,00000000,Function_0005D7B0,00000000,00000000,00000000), ref: 00460301
WaitForSingleObject.KERNEL32(?,000493E0), ref: 004604BE
WaitForSingleObject.KERNEL32(?,000493E0), ref: 0046056B
OutputDebugStringA.KERNELBASE( drthdrthdrthdr hrtd hr,0051D9CA,?,?), ref: 00460FAA
CloseHandle.KERNEL32(?), ref: 004607EF

Part of subcall function 00462D20: Concurrency::cancel_current_task.LIBCPMT ref: 00463084

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 004610D8
GetLastError.KERNEL32 ref: 004610ED
Sleep.KERNEL32(00007530), ref: 00461109
Sleep.KERNEL32(00000064), ref: 00461174
Sleep.KERNELBASE(00000BB8,?,?), ref: 004611A9
shutdown.WS2_32(00000002), ref: 004611B3
closesocket.WS2_32 ref: 004611BF
Sleep.KERNEL32(000003E8,?,?), ref: 004611D7

Strings

h0u, xrefs: 00461104
ntdll.dll, xrefs: 0045F203
6$, xrefs: 0045F041
ewetwertyer eytdryrtdy, xrefs: 0045F2EB
/+, xrefs: 0045F01C
($, xrefs: 0045F0B0
", xrefs: 00460A7E
45 hgfch rtdyt gfch, xrefs: 0045FEA0
pt, xrefs: 0045FA74
0w, xrefs: 0045F63B
hHBT, xrefs: 00460FE2
wc, xrefs: 0045EF14
hXCT, xrefs: 00460FF8
3f, xrefs: 0045EE78
td ydrthrhfty, xrefs: 0045F4C6
S2, xrefs: 0045F618
<3, xrefs: 0045F08B
#@#^@#TGRERTERYERY, xrefs: 0045F22F
[7, xrefs: 0045F240
jjj, xrefs: 0045FEC1
hxCT, xrefs: 0046100E
4, xrefs: 00460E3C
1, xrefs: 00460F6B
69, xrefs: 0045F0FA
jjj, xrefs: 0045FED2
)4, xrefs: 0045F11F
hhCT, xrefs: 00461024
drthdrthdrthdr hrtd hr, xrefs: 00460FA5
(?, xrefs: 0045F144
?', xrefs: 0045F066
PnE, xrefs: 0046105C
pt, xrefs: 0045F7D3
pt, xrefs: 0045FD13
<$, xrefs: 0045F169
hK<, xrefs: 0045ED2D
0:, xrefs: 0045F0D5

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Create$Thread$Sleep$DebugOutputString$ObjectSingleWait$ErrorHandleLastMutexclosesocketshutdown$AddressCleanupCloseConcurrency::cancel_current_taskCurrentModuleProcProcessUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: drthdrthdrthdr hrtd hr$"$#@#^@#TGRERTERYERY$($$(?$)4$/+$0:$1$4$45 hgfch rtdyt gfch$6$$69$<$$<3$?'$PnE$ewetwertyer eytdryrtdy$h0u$hHBT$hK<$hXCT$hhCT$hxCT$jjj$jjj$ntdll.dll$pt$pt$pt$td ydrthrhfty$0w$3f$S2$[7$wc
API String ID: 2410146291-2344865644
Opcode ID: 875fde1e0b677f64485a8b47dddb4892b6867e61e92a1a5bb6012f405d97af48
Instruction ID: 6c641780734558e821d7ba720d099a6b6e2cbdf30005073ce3c1c43e9fa6c162
Opcode Fuzzy Hash: 875fde1e0b677f64485a8b47dddb4892b6867e61e92a1a5bb6012f405d97af48
Instruction Fuzzy Hash: 4043BF30900258DBCB25DF68C855BEEBBB0AF15308F1441DED4456B392EB78AE49CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD50 Relevance: 92.5, APIs: 43, Strings: 9, Instructions: 1490
registrytimeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AF30: GetCurrentProcess.KERNEL32(00000000,?,?,0040C4BE), ref: 0040AF3F
Part of subcall function 0040AF30: IsWow64Process.KERNEL32(00000000,?,0040C4BE), ref: 0040AF46

Part of subcall function 004EAB9B: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000000,00000000,?,00403276,00000000,0045DC3C,00000000), ref: 004EABB0
Part of subcall function 004EAB9B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EABCF

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,EE141028,00000000), ref: 0040CF74
RegQueryValueExA.KERNELBASE(00000000,E81C1F30,00000000,00020019,?,00000400), ref: 0040CFCC
RegCloseKey.ADVAPI32(00000000), ref: 0040D002
GetCurrentHwProfileA.ADVAPI32(?), ref: 0040D0A7
GetModuleHandleExA.KERNEL32(00000004,Function_0000BD20,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0040D3A8
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,00000000,00000000), ref: 0040D3BD
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,EE141028,00000000), ref: 0040D65A
RegQueryValueExA.KERNELBASE(00000000,E4100C2D,00000000,00020019,?,00000400), ref: 0040D6B2
RegCloseKey.ADVAPI32(00000000), ref: 0040D721
GetComputerNameA.KERNEL32(?,00000104), ref: 0040D755
GetUserNameA.ADVAPI32(?,00000104), ref: 0040D80F
GetDesktopWindow.USER32 ref: 0040D840
GetWindowRect.USER32(00000000,?), ref: 0040D84E
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 0040D8CD
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040D9CA
LocalAlloc.KERNEL32(00000040), ref: 0040D9D9
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040D9EE
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040DA16
LocalFree.KERNEL32(EE141028), ref: 0040DA8B
GetLocalTime.KERNEL32(?), ref: 0040DAA2
GetSystemTime.KERNEL32(?), ref: 0040DB30
GetTimeZoneInformation.KERNELBASE(?), ref: 0040DB53
TzSpecificLocalTimeToSystemTime.KERNELBASE(?,?,?), ref: 0040DB78
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,00000000), ref: 0040DC84
RegQueryValueExA.KERNELBASE(00000000,?,00000000,00020019,?,00000400), ref: 0040DCD9
RegCloseKey.ADVAPI32(00000000), ref: 0040DD14
GetSystemInfo.KERNELBASE(?), ref: 0040DD3C
GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 0040DD7D
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 0040DE21
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 0040DFF9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E04C
Process32First.KERNEL32(00000000,00000128), ref: 0040E064
Process32Next.KERNEL32(00000000,00000128), ref: 0040E076
Process32Next.KERNEL32(00000000,?), ref: 0040E0C2
CloseHandle.KERNEL32(00000000), ref: 0040E0CD
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,?), ref: 0040E181
RegEnumKeyExA.KERNELBASE(00000000,00000000,?,01000D58,00000000,00000000,00000000,00000000), ref: 0040E1B2
wsprintfA.USER32 ref: 0040E1F8
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020019,01000D58), ref: 0040E218
RegQueryValueExA.KERNELBASE(01000D58,F00C1739,00000000,000F003F,?,00000400), ref: 0040E26D
RegQueryValueExA.KERNELBASE(01000D58,F00C1739,00000000,000F003F,?,00000400), ref: 0040E2B7
RegCloseKey.ADVAPI32(01000D58), ref: 0040E2FF
RegCloseKey.ADVAPI32(00000000), ref: 0040E317

Strings

X, xrefs: 0040E0FA
X, xrefs: 0040DBF4
?, xrefs: 0040E229
P, xrefs: 0040D57D
@, xrefs: 0040D1C5
", xrefs: 0040D14B
@, xrefs: 0040DD6C
pt/, xrefs: 0040D3ED, 0040D3F0
b, xrefs: 0040E4EA

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Time$Close$OpenQueryValue$LocalNameSystem$EnumProcess32$CurrentDevicesDisplayFileHandleInfoKeyboardLayoutListLocaleModuleNextProcessUserWindow$AllocComputerCreateDefaultDesktopFirstFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: "$?$@$@$P$X$X$b$pt/
API String ID: 3690012277-2877099211
Opcode ID: ff3135fc719a78f5270d7665580d88a305c6dcacea43571ddee4e838c0b3e866
Instruction ID: 5f0dfbe202ebed62e8e1fc962ad7b47538b82224645736a3c109de223eb16045
Opcode Fuzzy Hash: ff3135fc719a78f5270d7665580d88a305c6dcacea43571ddee4e838c0b3e866
Instruction Fuzzy Hash: ACE29071C0025DDADB11DBA4CC45BEEB7B8BF15308F00419AE549B7292EBB81B89CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00442940 Relevance: 87.1, APIs: 40, Strings: 8, Instructions: 3075fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 00442C53
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442CAF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004434EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443639
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 004436EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0044383A
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 004438D6
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443A09
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443AA4
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443BFE
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443C97
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443ED8
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444039
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00444292
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,00000000), ref: 00444416
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0044483E
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444898
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444A1E
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444CE4
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00444E4E
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00444B76

Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00445C65
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00445CC0
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0044337F

Part of subcall function 0040E7B0: FindFirstFileA.KERNEL32(00000000,AA515422,?,AA515421,00445E27,00000000,AA515421,AA515422,74DF3100,?), ref: 0040E929

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442CE0

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442E08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442E37
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00442F2F
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443029
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443087
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004431B8
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0044324A

Strings

!, xrefs: 0044422A
!*3, xrefs: 004436A5
!9, xrefs: 0044303D
!, xrefs: 00443E70
_, xrefs: 00444676
!2, xrefs: 00443A51
!, xrefs: 0044566E
+, xrefs: 00445E83

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CreateDirectory$File$Copy$Cpp_errorFolderPathThrow_std::_$AttributesErrorFindFirstLast
String ID: !$!$!$!*3$!2$!9$+$_
API String ID: 2574188035-3231385310
Opcode ID: 90ea648ec7e5144d9d7e51a02eab93e2dfaacc108a9fdab915825b38430a0943
Instruction ID: 025911db0c563e97186e133afa2aa293af237d43ae1464fea8b21352b95799e4
Opcode Fuzzy Hash: 90ea648ec7e5144d9d7e51a02eab93e2dfaacc108a9fdab915825b38430a0943
Instruction Fuzzy Hash: FE637D70C04298DADB21EBA5CD557DEBB74AF21308F4441DAD449772C2EBB81B88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00446020 Relevance: 71.3, APIs: 13, Strings: 26, Instructions: 3085registryfilecomCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004485E3
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,?,?), ref: 004486E2
RegCloseKey.ADVAPI32(?,?,?), ref: 0044870C
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00448973
GetUserNameA.ADVAPI32(?,00000104), ref: 004489A9

Part of subcall function 004160B0: GetModuleHandleA.KERNEL32(EE0D1B36,?), ref: 00416186
Part of subcall function 004160B0: GetProcAddress.KERNEL32(00000000,E11A0C3E), ref: 00416191
Part of subcall function 004160B0: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004161E1

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020006), ref: 0044865A

Part of subcall function 00415E30: GetFileAttributesA.KERNELBASE(?,7FFFFFFF), ref: 00415EDC

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004490D9
SHGetFolderPathA.SHELL32(00000000,00000007,00000000,00000000,?), ref: 004490F6
CoInitialize.OLE32(00000000), ref: 004491DD
CoCreateInstance.OLE32(Function_00115570,00000000,00000001,Function_00115540,?), ref: 004491FD
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 00449289
CoUninitialize.OLE32 ref: 004492B9
ShellExecuteA.SHELL32(00000000,EE1A0E12,00000000,00000000,00000000,00000001), ref: 00449327

Strings

Q, xrefs: 004462F2
!, xrefs: 00448EE5
S, xrefs: 00446CAA
!, xrefs: 00448524
], xrefs: 00446574
S, xrefs: 0044701A
!, xrefs: 0044901E
Q, xrefs: 00446685
S, xrefs: 0044809E
Q, xrefs: 004465B0
", xrefs: 00448F0C
", xrefs: 004487A2
!, xrefs: 0044877B
!, xrefs: 00448440
", xrefs: 004489F9
Q, xrefs: 00446955
", xrefs: 00448686
!, xrefs: 004488B4
, xrefs: 0044941F
], xrefs: 004464B8
!, xrefs: 004480C6
", xrefs: 00448467
S, xrefs: 00447A71
!, xrefs: 0044913A
", xrefs: 00448C45
Q, xrefs: 00446869

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: File$Copy$AttributesCreate$AddressByteCharCloseErrorExecuteFolderHandleInitializeInstanceLastModuleMultiNameOpenPathProcProcessShellUninitializeUserValueWide
String ID: $!$!$!$!$!$!$!$!$"$"$"$"$"$"$Q$Q$Q$Q$Q$S$S$S$S$]$]
API String ID: 28878968-1574997588
Opcode ID: eb3c67ee43f5d0ba5e937f94368f7f9067faab96f8ee18e0c941c97c20be299e
Instruction ID: 139baba76caebeb6474e4cab1ec68c198fad151c4d689f4ddca6dd48a2d49319
Opcode Fuzzy Hash: eb3c67ee43f5d0ba5e937f94368f7f9067faab96f8ee18e0c941c97c20be299e
Instruction Fuzzy Hash: 00639A70D042689ADB24EB64CD55BDEBBB4AF11308F0441DAE449772D2EB781F88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0045E5D4 Relevance: 49.4, APIs: 16, Strings: 12, Instructions: 450
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0041E220,00000000,00000000,00000000), ref: 0045E684
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0045E68B
Sleep.KERNELBASE(00000001), ref: 0045E738
GetTempPathA.KERNEL32(000000FB,?,00000000), ref: 0045E78E

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 0045E927
CreateDirectoryA.KERNELBASE(00000000,00000000,?,00000000), ref: 0045E953
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045E96A

Strings

jjj, xrefs: 0045E675
h0u, xrefs: 00461104
hxCT, xrefs: 0046100E
PnE, xrefs: 0046105C
'$, xrefs: 0045E74D
hHBT, xrefs: 00460FE2
G, xrefs: 0045E5D7
hXCT, xrefs: 00460FF8
drthdrthdrthdr hrtd hr, xrefs: 00460FA5
hhCT, xrefs: 00461024
>i, xrefs: 0045E94D
pi, xrefs: 0045E91B

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Create$Directory$AttributesChangeCloseErrorFileFindLastNotificationPathSleepTempThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: drthdrthdrthdr hrtd hr$'$$G$PnE$h0u$hHBT$hXCT$hhCT$hxCT$jjj$>i$pi
API String ID: 2868636072-2408573651
Opcode ID: 528529b8c08875bfe406a238d9223f4ea08e23f5f7d8b4d7c99976c2826d5508
Instruction ID: 6e5cd99d858afc9114efc19baa8da0ef7fd2211a61123bf09def4f2b3c7b9294
Opcode Fuzzy Hash: 528529b8c08875bfe406a238d9223f4ea08e23f5f7d8b4d7c99976c2826d5508
Instruction Fuzzy Hash: AB121430A00248CBCB18EB69CC55BDEBB71AF55308F1441DED9056B2D2EB785F48CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0045CC40 Relevance: 33.9, APIs: 10, Strings: 9, Instructions: 688
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00442BC0: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 00442C53
Part of subcall function 00442BC0: CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442CAF
Part of subcall function 00442BC0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442CE0

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045CCE2
CreateDirectoryA.KERNEL32(?,00000000,-00000034,-0000004C), ref: 0045CE22
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,-00000034,-0000004C), ref: 0045CEB5
CreateDirectoryA.KERNEL32(?,00000000,?,00000000,?,?,-00000034,-0000004C), ref: 0045CF4B
CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,-00000034,-0000004C), ref: 0045D094
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045D1C8
CreateDirectoryA.KERNEL32(?,00000000,-00000034,-0000004C), ref: 0045D2ED
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,-00000034,-0000004C), ref: 0045D39B
CreateDirectoryA.KERNEL32(?,00000000,?,00000000,?,?,-00000034,-0000004C), ref: 0045D44C
CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,-00000034,-0000004C), ref: 0045D583

Strings

!, xrefs: 0045CD9A
!, xrefs: 0045CE2C
!, xrefs: 0045D280
!, xrefs: 0045D4F1
!, xrefs: 0045CECC
!, xrefs: 0045D3B2
!, xrefs: 0045D2F7
&, xrefs: 0045D636
!, xrefs: 0045CFE7

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CreateDirectory$FolderPath
String ID: !$!$!$!$!$!$!$!$&
API String ID: 2162323195-3870512404
Opcode ID: b2431186a464716f6764598b4976cd052f309564fbbaf73e648e8f439ff1bff5
Instruction ID: 98fd23d24cb48da29d058820bf00fed71ec261f9da1009b6e8183a7bb0bc2d35
Opcode Fuzzy Hash: b2431186a464716f6764598b4976cd052f309564fbbaf73e648e8f439ff1bff5
Instruction Fuzzy Hash: B762B131D0428CDEDB10DBA4C955BDEBBB4AF21308F5400AEE44577282EBB85F89DB56

Uniqueness

Uniqueness Score: -1.00%

Function 00458520 Relevance: 33.2, APIs: 3, Strings: 15, Instructions: 1711COMMON

Download Yara Rule

APIs

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

Part of subcall function 0040B270: CreateDirectoryA.KERNELBASE(?,00000000,00000005,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B2B5

Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
Part of subcall function 0040B1A0: std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00459B2F
CreateDirectoryA.KERNEL32(?,00000000,00000000,?), ref: 00459CDC
CreateDirectoryA.KERNEL32(?,00000000,00000000,?), ref: 00459DA2

Strings

!, xrefs: 0045924D
!, xrefs: 004589C8
", xrefs: 0045936B
!<, xrefs: 00459AB9
", xrefs: 0045895C
!, xrefs: 0045879C
!, xrefs: 0045883E
", xrefs: 0045A333
!, xrefs: 004593BE
!, xrefs: 00459C45
!<, xrefs: 00458636
!, xrefs: 00459D13
!, xrefs: 00459E7C
!, xrefs: 00459192
", xrefs: 00459E29

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID: !$!$!$!$!$!$!$!$!$!<$!<$"$"$"$"
API String ID: 453214671-3335657276
Opcode ID: a7a9c483997c18c838695e24effe8083b9d73f7fd635aff4d7b3a7e21d12edc3
Instruction ID: c5f7a8c617223072bfb1229ec1c2afc80d8dcdf8a08cc0219ebc6f95682f2529
Opcode Fuzzy Hash: a7a9c483997c18c838695e24effe8083b9d73f7fd635aff4d7b3a7e21d12edc3
Instruction Fuzzy Hash: 3B037B70904298DEDB25EB64C9597DEBBB4AF11308F0440DED44977292EBB81F88CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00428180 Relevance: 31.4, APIs: 2, Strings: 14, Instructions: 3351COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,EB10111E), ref: 004282B4

Part of subcall function 0040AB40: __fread_nolock.LIBCMT ref: 0040AC3C

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042A957

Part of subcall function 004DE42B: RaiseException.KERNEL32(E06D7363,00000001,00000003,0045DCD0,0045DCD0,?,?,004DAF37,0045DCD0,0053D744,00000000,0045DCD0,00000000,00000001), ref: 004DE48B

Strings

\, xrefs: 00429C2D
\, xrefs: 004293AC
\, xrefs: 004291F6
[, xrefs: 0042B641
\, xrefs: 00429428
\, xrefs: 0042892A
1, xrefs: 0042A4D9
\, xrefs: 00429BAE
1, xrefs: 0042A099
\, xrefs: 00428515
cannot use operator[] with a string argument with , xrefs: 0042B53A, 0042B58C, 0042B5DE, 0042B630
\, xrefs: 00428AAD
\, xrefs: 00428EF4
\, xrefs: 00428F6A

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ExceptionFolderPathRaiseUnothrow_t@std@@@__ehfuncinfo$??2@__fread_nolock
String ID: 1$1$[$\$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 763711979-1380508078
Opcode ID: c7ad71056cc14307d38f6abb9f529e30568558c8efab3d43691259c466a99dba
Instruction ID: 971abde32ae973583efdc70f891493b7db531d9fc98c446d8c82e5115decafcc
Opcode Fuzzy Hash: c7ad71056cc14307d38f6abb9f529e30568558c8efab3d43691259c466a99dba
Instruction Fuzzy Hash: 8F73BD70D042A88BDB25DB28CC547EEBBB4AF15308F1441DED44967282DB795F88CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0045DDE5 Relevance: 25.0, APIs: 8, Strings: 6, Instructions: 538
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 0045DE2C
GetProcAddress.KERNEL32(00000000,00000000), ref: 0045DE74
MessageBoxA.USER32(00000000,00000000,00000000,00000014), ref: 0045DFEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045E088
GetProcessId.KERNELBASE(0000A9BE,00000000,00000000,00000003,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0045E0E5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045E414
SetThreadExecutionState.KERNEL32(80000041), ref: 0045E47D
SetThreadExecutionState.KERNEL32(80000001), ref: 0045E488

Part of subcall function 00414ED0: CoInitializeEx.OLE32(00000000), ref: 00414F21
Part of subcall function 00414ED0: CoCreateInstance.OLE32(0051F29C,00000000,00000001,005264AC,00000000), ref: 00414F5B
Part of subcall function 00414ED0: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 0041500D

Strings

0Dl, xrefs: 0045DEA1
VW}8, xrefs: 0045E01C
P5m, xrefs: 0045E385
^?, xrefs: 0045E3AD
$?, xrefs: 0045E3E7
P5n, xrefs: 0045E285

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CreateExecutionStateThreadUnothrow_t@std@@@__ehfuncinfo$??2@$AddressInitializeInstanceLibraryLoadMessageProcProcess
String ID: 0Dl$P5m$P5n$VW}8$$?$^?
API String ID: 3671032131-3693957406
Opcode ID: c5cf5b41cfba225ef6329929671c39fa8cb385e1aa91efd481a0732229720008
Instruction ID: d05b7a526c526fb25ac86900d23d82a76dfacb57d7154bee3789098c3e461034
Opcode Fuzzy Hash: c5cf5b41cfba225ef6329929671c39fa8cb385e1aa91efd481a0732229720008
Instruction Fuzzy Hash: 4432E175A00614CBCB28CF55C894BAEB7B1FF59309F14419ADD046B392EB34AE49CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0042C980 Relevance: 24.9, APIs: 1, Strings: 12, Instructions: 2164COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,EB100A1A,?,?,?,00000004), ref: 0042CAB4

Strings

\, xrefs: 0042D8E4
\, xrefs: 0042E0A2
\, xrefs: 0042D24A
cannot use operator[] with a string argument with , xrefs: 0042EB50
V, xrefs: 0042EB61
\, xrefs: 0042D0D0
\, xrefs: 0042E0D2
\, xrefs: 0042D657
\, xrefs: 0042D68B
\, xrefs: 0042DA7A
\, xrefs: 0042DAB1
\, xrefs: 0042CC34

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: V$\$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 1514166925-852427314
Opcode ID: 7a92e4d2efc8a7d3982d1c0e98320d833f3b99e16c11bd0952f5b9746d040943
Instruction ID: 93d48fb3b7394a7a9c545578b9020dcc270c056067832ed45d6f7c74abe25d34
Opcode Fuzzy Hash: 7a92e4d2efc8a7d3982d1c0e98320d833f3b99e16c11bd0952f5b9746d040943
Instruction Fuzzy Hash: DD23CE70D002A88ADF25DB68CD457EEBBB0AF15304F1442DEE44977282DBB85B89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00434B20 Relevance: 23.8, APIs: 6, Strings: 6, Instructions: 2842stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00434C41
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00434CE6
GetPrivateProfileStringA.KERNEL32(?,E80B1F2D,00000000,?,00000104,?), ref: 00434DB6
lstrlenA.KERNEL32(?), ref: 00437778

Part of subcall function 0040AB40: __fread_nolock.LIBCMT ref: 0040AC3C

CreateDirectoryA.KERNEL32(?,00000000,?,!/,?,00000000,!/,!/,?,?,E9181111,E9181111,00000000), ref: 00436806
CreateDirectoryA.KERNEL32(?,00000000), ref: 00436B77

Strings

\, xrefs: 0043694E
3, xrefs: 00437814
cannot use operator[] with a string argument with , xrefs: 00437803, 0043785D
_, xrefs: 0043693E
\, xrefs: 00434DBC
!/, xrefs: 0043677E, 004367A9

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CreateDirectoryPrivateProfile$FolderNamesPathSectionString__fread_nolocklstrlen
String ID: !/$3$\$\$_$cannot use operator[] with a string argument with
API String ID: 2628882823-2383513987
Opcode ID: 7f008d2b1d43d3440f0b736f4e868794396d9013d87c5915d0065dada75c57de
Instruction ID: 1ce51221f2985692f3453a56c8f933069d7efec376c23e296511ddad2afc8776
Opcode Fuzzy Hash: 7f008d2b1d43d3440f0b736f4e868794396d9013d87c5915d0065dada75c57de
Instruction Fuzzy Hash: FF53E170C042989EDF25CB64CC497EEBBB4AF15304F1481DED44967282DB785B89CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040B300 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 297
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,?,DT,?,?,?,\*.*,00000004), ref: 0040B423
std::_Throw_Cpp_error.LIBCPMT ref: 0040B714
std::_Throw_Cpp_error.LIBCPMT ref: 0040B725

Strings

\*.*, xrefs: 0040B3B0
DT, xrefs: 0040B3B8

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$FileFindFirst
String ID: \*.*$DT
API String ID: 1487763586-2523999094
Opcode ID: 4a29aba26bec869d3660ca0283637983aa92af40795304ad3570c6c34889b601
Instruction ID: ac939954ec097e0f466dd701cbb477dfb9ac36ed8f0a1d488013fd253ef2818d
Opcode Fuzzy Hash: 4a29aba26bec869d3660ca0283637983aa92af40795304ad3570c6c34889b601
Instruction Fuzzy Hash: FCC1CF70D00249CFDB10DFA4C8487EEBBB1FF55314F14426AE044BB292E7B45A88DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00440C10 Relevance: 21.9, APIs: 9, Strings: 3, Instructions: 926
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?,00544428,?,E9181111,?,?,?,00000000), ref: 00440D5B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00440D99
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00000000), ref: 00440DC8
RegQueryValueExA.ADVAPI32(?,E91E1338,00000000,00000001,?,00000104), ref: 00440EBF
RegQueryValueExA.ADVAPI32(?,D03E3334,00000000,00000001,?,00000104,?,?,?,?,0000002D,?), ref: 00440FEF

Strings

-, xrefs: 00440F29
cannot use operator[] with a string argument with , xrefs: 00441D97
!, xrefs: 00441B37

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$Enum
String ID: !$-$cannot use operator[] with a string argument with
API String ID: 2712010499-1276644407
Opcode ID: 2cae61403f8ba5b001ee441a9bc76ed959ca99549b7a748f4f64741000691798
Instruction ID: 467e1f61573673e568cb322bcfad3a158302ffbc17161ed4d3dffea1a2fad12a
Opcode Fuzzy Hash: 2cae61403f8ba5b001ee441a9bc76ed959ca99549b7a748f4f64741000691798
Instruction Fuzzy Hash: B3929B70C002989FEB25CB64CC94BDDBBB4AF55304F1481DAD449A7292EBB85BC8CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0044A8F0 Relevance: 20.6, APIs: 6, Strings: 5, Instructions: 1320COMMON

Download Yara Rule

APIs

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 0044AD86
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,D33A3A59,?,?), ref: 0044AF74
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?,?,?,?,?,?,?,C3303A59,?,?), ref: 0044B176
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,C52C2B59,?,?), ref: 0044B404

Strings

, xrefs: 0044C029
Q^, xrefs: 0044AC71
type must be boolean, but is , xrefs: 0044C114
*, xrefs: 0044BCE3
:, xrefs: 0044ABFE

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderPath$AttributesErrorFileLast
String ID: $*$:$Q^$type must be boolean, but is
API String ID: 133263752-2910639182
Opcode ID: f8a5c1fd18049b14770c9d83c876d00c3ab7aaff4ac436de6173ae7118f918e5
Instruction ID: f601a768aac6b107c1b52a814d78b372fed79b1e5d76e311e5bac06f3818e39b
Opcode Fuzzy Hash: f8a5c1fd18049b14770c9d83c876d00c3ab7aaff4ac436de6173ae7118f918e5
Instruction Fuzzy Hash: 12C2F170C042589AEF25CF64C859BEEBB74AF16304F1081DED44977282EB785B89CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B65D Relevance: 19.4, APIs: 2, Strings: 8, Instructions: 1862COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,E80B1F2D,00000000,?,00000104,?), ref: 00439D16

Strings

/, xrefs: 00439E4C
1, xrefs: 0043A4EA
cannot use operator[] with a string argument with , xrefs: 0043B6BE, 0043B6FA
\, xrefs: 00439F61
TbE, xrefs: 0043B685
@, xrefs: 0043B44A
1, xrefs: 0043AAA1
\, xrefs: 00439D1C

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: PrivateProfileString
String ID: /$1$1$@$TbE$\$\$cannot use operator[] with a string argument with
API String ID: 1096422788-1445346722
Opcode ID: 2965c0b2003d1651e8eb03f83b992031b88ba7001cac5faaa004735bee3f47b6
Instruction ID: 48f681746d01d8606fd5da3aba38660e17bb2eb0aa84c3269b79c46dcc56e974
Opcode Fuzzy Hash: 2965c0b2003d1651e8eb03f83b992031b88ba7001cac5faaa004735bee3f47b6
Instruction Fuzzy Hash: 7D03E270D002599BDB25DB24C8487EEBBB0AF19308F1481DED48967382D778AF85CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0045B4B0 Relevance: 18.7, Strings: 14, Instructions: 1224COMMON

Download Yara Rule

Strings

!, xrefs: 0045BFEB
!, xrefs: 0045B74E
!, xrefs: 0045B8BF
!, xrefs: 0045B6A7
P, xrefs: 0045C528
!, xrefs: 0045BE97
, xrefs: 0045C874
", xrefs: 0045B872
", xrefs: 0045BF9E
!<, xrefs: 0045B516
!, xrefs: 0045BDD7
!=<, xrefs: 0045BC56
P, xrefs: 0045C719
!<, xrefs: 0045BC49

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID: $!$!$!$!$!$!$!<$!<$!=<$"$"$P$P
API String ID: 674977465-849160089
Opcode ID: 5f961a8c59e3abbcd852215698635d93fbf3bef1801bfa62208ebea6883c0baf
Instruction ID: aaf53db0e1b4d15e6be1d28252f3172ce73b50c3640e64186e45e7c1d5f19c6e
Opcode Fuzzy Hash: 5f961a8c59e3abbcd852215698635d93fbf3bef1801bfa62208ebea6883c0baf
Instruction Fuzzy Hash: 93C2AE708042989EDB25DB64CC597DEBBB4AF11308F0441DED44977292EBB81F88DF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004378A0 Relevance: 18.5, APIs: 4, Strings: 6, Instructions: 1023stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 004379A8
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00437A51
GetPrivateProfileStringA.KERNEL32(?,E80B1F2D,00000000,?,00000104,?), ref: 00437B09
lstrlenA.KERNEL32(?), ref: 0043865B

Strings

, xrefs: 004386E9
cannot use operator[] with a string argument with , xrefs: 004386D8, 0043872D
\, xrefs: 00437D4B
/, xrefs: 00437C36
\, xrefs: 00437B0F
'7/, xrefs: 00438212

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: $'7/$/$\$\$cannot use operator[] with a string argument with
API String ID: 1311570089-2982360621
Opcode ID: 8856ee1443d33a6323f86d2b2cabd39d1ae4f5180e08f34482b4ff18a460cfa1
Instruction ID: 9f976b58b8be0850a844ace8a6271eea27716fe17c03b5f0162a7ffe5c17bfa4
Opcode Fuzzy Hash: 8856ee1443d33a6323f86d2b2cabd39d1ae4f5180e08f34482b4ff18a460cfa1
Instruction Fuzzy Hash: 9BA2F470D04258DBDF24DF64C844BDEBBB4AF19308F1441DEE449A7282EB789A89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E220 Relevance: 18.3, APIs: 12, Instructions: 260
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(0000038C,0000FFFF,00001006,?,00000008), ref: 0041E2B2
recv.WS2_32(?,00000004,00000002), ref: 0041E2CD
WSAGetLastError.WS2_32 ref: 0041E2D1
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 0041E34F
recv.WS2_32(00000000,0000000C,00000008), ref: 0041E370
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 0041E40C
recv.WS2_32(00000000,?,00000008), ref: 0041E427

Part of subcall function 0041D430: WSAStartup.WS2_32 ref: 0041D45A
Part of subcall function 0041D430: getaddrinfo.WS2_32(?,?,?,00544318), ref: 0041D4DC
Part of subcall function 0041D430: socket.WS2_32(?,?,?), ref: 0041D4FD
Part of subcall function 0041D430: connect.WS2_32(00000000,?,?), ref: 0041D511
Part of subcall function 0041D430: closesocket.WS2_32(00000000), ref: 0041D51D
Part of subcall function 0041D430: freeaddrinfo.WS2_32(?,?,?,?,00544318,?,?), ref: 0041D52A
Part of subcall function 0041D430: WSACleanup.WS2_32 ref: 0041D530

recv.WS2_32(?,00000004,00000008), ref: 0041E52F
__Xtime_get_ticks.LIBCPMT ref: 0041E536
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041E544
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 0041E5BD
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 0041E5C5

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID:
API String ID: 4125349891-0
Opcode ID: 58cb50fad8bfee238d794f3ab8072a6dc5a148d89207eb05ecb41e0d4a435300
Instruction ID: 445f019a92e67a07c5577944838b6ba889f153fe2f7e7f97530082f2635256d3
Opcode Fuzzy Hash: 58cb50fad8bfee238d794f3ab8072a6dc5a148d89207eb05ecb41e0d4a435300
Instruction Fuzzy Hash: BFB1BB74D00208DFDB10DFA5DC49BDEBBB1BF55308F20421AE514AB2D2E7B85989DB85

Uniqueness

Uniqueness Score: -1.00%

Function 004202AA Relevance: 16.8, Strings: 12, Instructions: 1844COMMON

Download Yara Rule

Strings

\, xrefs: 00421307
\, xrefs: 0042128B
2, xrefs: 004221C5
\, xrefs: 004204DA
\, xrefs: 00420892
\, xrefs: 00420D88
cannot use operator[] with a string argument with , xrefs: 004222CA, 0042231F
\, xrefs: 00420B6F
\, xrefs: 00420369
\, xrefs: 00420908
\, xrefs: 00420D12
N, xrefs: 00422330

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID: 2$N$\$\$\$\$\$\$\$\$\$cannot use operator[] with a string argument with
API String ID: 0-3997232999
Opcode ID: 39b1c78cc260389004a9945ae1215db3ef1f2606071fc9a6093dcbdc2b2998ea
Instruction ID: 142a1333c886f7168f4796e51cba4106daa42fe8ca959b633c77b9f205a70950
Opcode Fuzzy Hash: 39b1c78cc260389004a9945ae1215db3ef1f2606071fc9a6093dcbdc2b2998ea
Instruction Fuzzy Hash: 3A03FF70D042A8CADB25DF68C9447EEBBB0AF25304F1441DED44977292DBB85B88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB90 Relevance: 15.7, APIs: 1, Strings: 7, Instructions: 1732COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,00000000), ref: 0042EBF6

Strings

\, xrefs: 0042F7EB
0, xrefs: 0043061C
\, xrefs: 0042ED97
\, xrefs: 0042FCA2
\, xrefs: 0042EFCB
\, xrefs: 0042FA1D
\, xrefs: 0042F2CE

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: 0$\$\$\$\$\$\
API String ID: 1514166925-2451213376
Opcode ID: 36860eb0e155d2f8010df601d171291f325214116c62a2c6aca437c35bd48e3b
Instruction ID: ff42d24a3409b96a5a3af719d977c7bdcf0e65b10999f228c8266e98d8d3b20c
Opcode Fuzzy Hash: 36860eb0e155d2f8010df601d171291f325214116c62a2c6aca437c35bd48e3b
Instruction Fuzzy Hash: EC03CE70C00298CBDB15CFA4C9547EEBBB4AF15304F1482EED44967282EBB85B89DF95

Uniqueness

Uniqueness Score: -1.00%

Function 004564A0 Relevance: 15.6, Strings: 11, Instructions: 1823COMMON

Download Yara Rule

Strings

!<, xrefs: 00456526
!, xrefs: 004569E1
X, xrefs: 00457352
X, xrefs: 00457690
X, xrefs: 00456B81
X, xrefs: 00458306
!, xrefs: 0045713D
!, xrefs: 00456862
XX, xrefs: 00458332
!, xrefs: 004571E9
i, xrefs: 00457B3D

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$AttributesCreateDirectoryErrorFileLast
String ID: !$!$!$!$!<$X$X$X$X$XX$i
API String ID: 325604351-2037772135
Opcode ID: 00640e7ae51c25515dbab57518f1b5585add5ccf1b9807717d4c2318bf2f91c0
Instruction ID: ecb2ca0d95ec8d52ec3e550aec8de0df42c26821c100c05c85970344710edf93
Opcode Fuzzy Hash: 00640e7ae51c25515dbab57518f1b5585add5ccf1b9807717d4c2318bf2f91c0
Instruction Fuzzy Hash: C0137B30804298DADB21DBA4CD597DDBBB4AF21308F4440EED44977292EBB81F88DF56

Uniqueness

Uniqueness Score: -1.00%

Function 0042B670 Relevance: 15.3, APIs: 2, Strings: 6, Instructions: 1311COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,F40C1715,?,?,?,?), ref: 0042B7A1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042C4A7

Strings

@, xrefs: 0042C696
\, xrefs: 0042B8F2
cannot use operator[] with a string argument with , xrefs: 0042C928
$, xrefs: 0042C939
\, xrefs: 0042BF10
\, xrefs: 0042BE98

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderPathUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: $$@$\$\$\$cannot use operator[] with a string argument with
API String ID: 2082173394-1541509089
Opcode ID: 6133f534c6a332d7941f26dfa8c2fbae13c62275449d7d66e0fd3f2e3009ec6c
Instruction ID: 19e61057b4de96387459b8fbb322fb78cfcc39abb5ced32acda83e23eefcc91f
Opcode Fuzzy Hash: 6133f534c6a332d7941f26dfa8c2fbae13c62275449d7d66e0fd3f2e3009ec6c
Instruction Fuzzy Hash: 60C2E170D002688BDB24DF68DD447EEBBB1AF55304F14819EE449AB282DB785A88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00431BE0 Relevance: 13.8, APIs: 1, Strings: 6, Instructions: 1514COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 00431C6A

Strings

@, xrefs: 00432E13
-, xrefs: 0043326A
\, xrefs: 0043255E
\, xrefs: 00432A87
\, xrefs: 00432B00
\, xrefs: 00431DB3

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: -$@$\$\$\$\
API String ID: 1514166925-2684308176
Opcode ID: dc0feb0ff27342ba2351010760a9a7fa9f17d55a1b17b16ef9f87e90b9ed826b
Instruction ID: d91b79af9706b3dcd8d39c7225c5b41485dc7db8cb22aba9996e65dd2ffe5a79
Opcode Fuzzy Hash: dc0feb0ff27342ba2351010760a9a7fa9f17d55a1b17b16ef9f87e90b9ed826b
Instruction Fuzzy Hash: 1AE2CC70D002588BDB24DF68CD497EEBBB1AF55308F1442DED4497B282DBB85B88CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043C800 Relevance: 13.7, APIs: 9, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(EC0A1F0B), ref: 0043C845
GetProcAddress.KERNEL32(00000000,?), ref: 0043C890
GetProcAddress.KERNEL32(?), ref: 0043C8CC
GetProcAddress.KERNEL32(EC0A1F2B), ref: 0043C90B
GetProcAddress.KERNEL32(EC0A1F2B), ref: 0043C94B
GetProcAddress.KERNEL32(?), ref: 0043C97E
GetProcAddress.KERNEL32(EC0A1F2B), ref: 0043C9BD
GetProcAddress.KERNEL32(EC0A1F2B), ref: 0043C9FC
FreeLibrary.KERNEL32 ref: 0043CA51

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID:
API String ID: 2449869053-0
Opcode ID: 1a03b80e99f2ae9b9d448c6761ef6ab857ef5f5529903590e56c350a4be63973
Instruction ID: b1d565e26da15637c44d487adb7fec3754ae83cdb862e226590c04255aff7c14
Opcode Fuzzy Hash: 1a03b80e99f2ae9b9d448c6761ef6ab857ef5f5529903590e56c350a4be63973
Instruction Fuzzy Hash: 20711574814288DEDB04CFA8E9497EE7BF8EF1E308F14506ED444BA221E3754259DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0045A490 Relevance: 13.4, Strings: 10, Instructions: 886
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!<, xrefs: 0045A4E8
", xrefs: 0045AF8C
!<, xrefs: 0045AC5B
!, xrefs: 0045AFF2
", xrefs: 0045A848
!, xrefs: 0045A895
!, xrefs: 0045ADB5
!, xrefs: 0045A675
!, xrefs: 0045AE75
!, xrefs: 0045A735

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID: !$!$!$!$!$!$!<$!<$"$"
API String ID: 674977465-4268256857
Opcode ID: 27049611b3e27e7561ed8f9592854416b11846d9743bc27a38aae9a19c33b6d1
Instruction ID: 5d91988631de9c64da63e99e6f9eee4dff0cc50ce4f01ab050edeb8638314a4c
Opcode Fuzzy Hash: 27049611b3e27e7561ed8f9592854416b11846d9743bc27a38aae9a19c33b6d1
Instruction Fuzzy Hash: 1592BF30804298DEDB21DB65C9557DEBBB0AF11308F0441DED44A77292EBB81F89DF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041AB90 Relevance: 13.0, Strings: 9, Instructions: 1711
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 0041ACC6, 0041AFE0, 0041BA6B
'$, xrefs: 0041CE65
v, xrefs: 0041C7CE
'$, xrefs: 0041B9CB
'$, xrefs: 0041C032
https://ipinfo.io/, xrefs: 0041B502
'$, xrefs: 0041C7E2
R, xrefs: 0041BABF
https://www.maxmind.com/en/locate-my-ip-address, xrefs: 0041C0AD

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: '$$'$$'$$'$$Content-Type: application/x-www-form-urlencoded$R$https://ipinfo.io/$https://www.maxmind.com/en/locate-my-ip-address$v
API String ID: 667068680-2061937629
Opcode ID: 826fd57540206e3bf1e6079d5728c1854fc311df49381f8b6000cc1682075660
Instruction ID: 405d04aefb3fce8c0c0cc81f026dd962f33e5c7b4d644263dc3e8c158a3863fa
Opcode Fuzzy Hash: 826fd57540206e3bf1e6079d5728c1854fc311df49381f8b6000cc1682075660
Instruction Fuzzy Hash: 09139B308086D9D9DB22D768CD587DDBFB05F22318F0442DAD0997B2D2D7B80B89DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040C490 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 416
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AF30: GetCurrentProcess.KERNEL32(00000000,?,?,0040C4BE), ref: 0040AF3F
Part of subcall function 0040AF30: IsWow64Process.KERNEL32(00000000,?,0040C4BE), ref: 0040AF46

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,-00020019,00000000,EE141028,EE141029,00000000), ref: 0040C571
RegQueryValueExA.KERNELBASE(00000000,E81C1F30,00000000,00020019,?,00000400), ref: 0040C5D1
RegCloseKey.ADVAPI32(00000000), ref: 0040C600
GetCurrentHwProfileA.ADVAPI32(?), ref: 0040C687

Strings

_, xrefs: 0040C6E6
_, xrefs: 0040C6D1
___, xrefs: 0040C6FE, 0040C726

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CurrentProcess$CloseOpenProfileQueryValueWow64
String ID: _$_$___
API String ID: 165412945-3771204864
Opcode ID: 494c1fda814901c24b13ed7c4ecfc889797ab3f93025f499c3c38bde76937db5
Instruction ID: 5751222aa254f6d9748874ec03cc5a69f204ea5eca6779fec1b35b27ceae82dc
Opcode Fuzzy Hash: 494c1fda814901c24b13ed7c4ecfc889797ab3f93025f499c3c38bde76937db5
Instruction Fuzzy Hash: EB02E470C00258DEDB15CFA4C854BEEBBB4AF15308F1442AEE44577292EBB85B88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004224D9 Relevance: 12.4, Strings: 9, Instructions: 1131COMMON

Download Yara Rule

Strings

, xrefs: 004233E7
\, xrefs: 004225E2
cannot use operator[] with a string argument with , xrefs: 00423604
\, xrefs: 00422C0E
'7/, xrefs: 00422FFE
), xrefs: 00423615
\, xrefs: 00422B96
'7/, xrefs: 00422FE3
@, xrefs: 0042338B

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID: $'7/$'7/$)$@$\$\$\$cannot use operator[] with a string argument with
API String ID: 0-332647325
Opcode ID: 801aa9ebdc0525f9831b497621d126c51bda5b67daad67d996e4387aabdf3845
Instruction ID: 61e97b4625812ccfc18c7b84ada4c7f8c9f9400c5d91a0ded182efbc8a5c6066
Opcode Fuzzy Hash: 801aa9ebdc0525f9831b497621d126c51bda5b67daad67d996e4387aabdf3845
Instruction Fuzzy Hash: 4EA2E170E00268DBDB14DF68D9447EEBBB0BF15304F14419EE449AB382DB78AE85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00423670 Relevance: 11.7, APIs: 1, Strings: 5, Instructions: 1183COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004237AB

Strings

\, xrefs: 00423F0B
@, xrefs: 0042448B
\, xrefs: 004238F3
\, xrefs: 00423E93
, xrefs: 00424515

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: $@$\$\$\
API String ID: 1514166925-3855809014
Opcode ID: cb9a08416f5a44a1aed852bb4bce2c0a1a148f8c2640d52e8ffd3e837192ccae
Instruction ID: f3345cdad3a7bf631cb8bea3eb755c4a26d33441534220e24a94c3e683fde97c
Opcode Fuzzy Hash: cb9a08416f5a44a1aed852bb4bce2c0a1a148f8c2640d52e8ffd3e837192ccae
Instruction Fuzzy Hash: 4DB2D070E00268CBDB14DF68D9447EEBBB1BF55304F14429EE449AB382DB785E84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00422852 Relevance: 10.8, Strings: 8, Instructions: 811COMMON

Download Yara Rule

Strings

, xrefs: 004233E7
cannot use operator[] with a string argument with , xrefs: 00423604
\, xrefs: 00422C0E
'7/, xrefs: 00422FFE
), xrefs: 00423615
, xrefs: 00423315
\, xrefs: 00422B96
'7/, xrefs: 00422FE3

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID: $ $'7/$'7/$)$\$\$cannot use operator[] with a string argument with
API String ID: 0-3193137110
Opcode ID: 0cdb4320ce717c51c1e3663c5c95e3e42166bb38a92de2325e9aa405f1978a16
Instruction ID: 707055d3f69e4e07746b85a66c6cfd133f65ba6d7924feda5609f4cec4274315
Opcode Fuzzy Hash: 0cdb4320ce717c51c1e3663c5c95e3e42166bb38a92de2325e9aa405f1978a16
Instruction Fuzzy Hash: 3372E270E00268DBDB24DF68D9457EEBBB0BF15308F14429ED44967382DB789A84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 271fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,01005421,?,?,01005421,01005422), ref: 0041FAA5

Strings

\, xrefs: 0041FB3B
!T, xrefs: 0041FA2B

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: !T$\
API String ID: 1974802433-3242880338
Opcode ID: 8fa89b8a99d316467619f03f1f750873defb4ff755c165f81a6727646345314b
Instruction ID: ad49764b5419d78d6ee9c6c252fc79b52b8fec3596e44256030d9def55ac6d48
Opcode Fuzzy Hash: 8fa89b8a99d316467619f03f1f750873defb4ff755c165f81a6727646345314b
Instruction Fuzzy Hash: 6CB1D0709002498FDF15CFA8C8547FEBBB0BF15308F14425EE455AB292D7785A8ADB94

Uniqueness

Uniqueness Score: -1.00%

Function 00406430 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 352COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004065C1
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004065FE
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004066F1
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0040673E

Strings

., xrefs: 00406710

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 8417005a20e023fd73ba9afad58ff86ec2193d77c7355dce5408bdd34dd6c1b5
Instruction ID: 0ef23cfc4c65f78b20a5b115fbe71865ac88f3790106b09d81af8426c26c804f
Opcode Fuzzy Hash: 8417005a20e023fd73ba9afad58ff86ec2193d77c7355dce5408bdd34dd6c1b5
Instruction Fuzzy Hash: 5AD1D071900616DFCB20CF58C8947AEB7B4FF48328F15466AD816A77C0D73AAD65CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0043CA90 Relevance: 9.1, APIs: 1, Strings: 3, Instructions: 2057COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32(00000000,00000001,00000000,?,?,?,E9181111,E9181112,00000001), ref: 0043DFD9

Part of subcall function 0040AF70: GetModuleHandleA.KERNEL32(EC1B0A33), ref: 0040AFE5
Part of subcall function 0040AF70: GetProcAddress.KERNEL32(00000000,C7130A2F), ref: 0040AFF0

Strings

hHS, xrefs: 0043E975
cannot use operator[] with a string argument with , xrefs: 0043DCF1, 0043DD26, 0043DD76, 0043DDA9, 0043DDFE, 0043E8F4, 0043E946
!, xrefs: 0043E905

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AddressCredEnumerateHandleModuleProc
String ID: !$cannot use operator[] with a string argument with $hHS
API String ID: 2949927473-2773771920
Opcode ID: 52aeae85547f70baa02dcd7f0409400fa51b087c8b8a370bd9cfa4d6aa2d3ef5
Instruction ID: 78b22a16384c3ecc8d55ced8a7577b3d60f2d080a590db0f4769b14bcf33a1ff
Opcode Fuzzy Hash: 52aeae85547f70baa02dcd7f0409400fa51b087c8b8a370bd9cfa4d6aa2d3ef5
Instruction Fuzzy Hash: 1713AB30D042988FDB25CF68C894BEEBBB1AF59304F1481DED44967382DB785A89CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0045D9F0 Relevance: 7.7, APIs: 5, Instructions: 159sleepCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0045DA07
GetCursorPos.USER32(?), ref: 0045DA15
Sleep.KERNELBASE(000003E9,?,?,00000000,?,?,?,?,?,?,?,?,0045DDB8), ref: 0045DACA
GetCursorPos.USER32(?), ref: 0045DAD1
Sleep.KERNELBASE(00000001,?,?,00000000,?,?,?,?,?,?,?,?,0045DDB8), ref: 0045DB87

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Cursor$Sleep
String ID:
API String ID: 1847515627-0
Opcode ID: 1694e71d0dae9a6905e43d5e89c9cdb7d8dc5d3e0a04ac429a78049a9d30e692
Instruction ID: bbdc7af5ffbae6873724ca49be0fa542b01cacdbe8070c35df16c5b9ace19829
Opcode Fuzzy Hash: 1694e71d0dae9a6905e43d5e89c9cdb7d8dc5d3e0a04ac429a78049a9d30e692
Instruction Fuzzy Hash: 7E519831A082428FC724CF18C4D0E6AB7E2EF89705F1A499AE8859B352D735FD09CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00422360 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 365COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,EF0B0B1C,?,?,?,?), ref: 00422491

Strings

cannot use operator[] with a string argument with , xrefs: 004235A0, 00423604
\, xrefs: 00422C0E
), xrefs: 00423615

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: )$\$cannot use operator[] with a string argument with
API String ID: 1514166925-4288521057
Opcode ID: 5ba642ec3cb0a91564e112746fcf88708c76d8ef936b5546a400d9f883f83e56
Instruction ID: eca74086b4d8b65fd649f7a6fdb4489f28162b6af86d504ff607bc194230852c
Opcode Fuzzy Hash: 5ba642ec3cb0a91564e112746fcf88708c76d8ef936b5546a400d9f883f83e56
Instruction Fuzzy Hash: 3BF1BD70D04268DADB14DF64C955BDEBBB4BF15308F1481DEE44967282DBB81B88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 004160B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162processlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(EE0D1B36,?), ref: 00416186
GetProcAddress.KERNEL32(00000000,E11A0C3E), ref: 00416191
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004161E1

Strings

D, xrefs: 004160EB

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AddressCreateHandleModuleProcProcess
String ID: D
API String ID: 3485509086-2746444292
Opcode ID: 99a203e40770f878a1aa0ca9a985e095ed35557a0b55e641c53b98455d8fb0e2
Instruction ID: ea7d779f1fc72c251558d129e53321ec91a959617f4191f212bf8088cf3ae0e6
Opcode Fuzzy Hash: 99a203e40770f878a1aa0ca9a985e095ed35557a0b55e641c53b98455d8fb0e2
Instruction Fuzzy Hash: 0151CF70A00218EFDB14CFA8CC85BEDBBB5FF44704F14419EE545AB292D778A946CB88

Uniqueness

Uniqueness Score: -1.00%

Function 004CB3C0 Relevance: 6.9, Strings: 4, Instructions: 1918COMMON

Download Yara Rule

Strings

too many terms in compound SELECT, xrefs: 004CB666
only a single result allowed for a SELECT that is part of an expression, xrefs: 004CB6AC
min, xrefs: 004CCC6B
max, xrefs: 004CCCCE

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID: max$min$only a single result allowed for a SELECT that is part of an expression$too many terms in compound SELECT
API String ID: 0-2877691265
Opcode ID: fbd03b09731f7fb73b0834140c81151357748eaef8a73ae9651058b7b71b28cb
Instruction ID: c1929985df6c20adc65602af42118a6c04867d104e31f5cdb5b9dcf57f3213a0
Opcode Fuzzy Hash: fbd03b09731f7fb73b0834140c81151357748eaef8a73ae9651058b7b71b28cb
Instruction Fuzzy Hash: 881356746047418FD724DF19C090F2ABBE1FF85308F15896EE98A8B352DB79E845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00491D10 Relevance: 6.2, APIs: 4, Instructions: 152fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000003,00000000,7FFFFFFD,?,00000000), ref: 00491D26
CreateFileA.KERNEL32(?,?,00000003,00000000,?,?,00000000,89005445), ref: 00491D2E
GetDiskFreeSpaceW.KERNELBASE(00000000,?,?,?,?), ref: 00491E5C
GetDiskFreeSpaceA.KERNEL32(00000000,?,?,?,?), ref: 00491E92

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CreateDiskFileFreeSpace
String ID:
API String ID: 3321825543-0
Opcode ID: 43ba0cbec80b2fa17c53ea0a5cf93c85ec04918b9e4dfa6bcad75a6e981aae53
Instruction ID: 83f738b45ce3571a5b1a543967aa25571774c38b0d664623fa16f6a30307302f
Opcode Fuzzy Hash: 43ba0cbec80b2fa17c53ea0a5cf93c85ec04918b9e4dfa6bcad75a6e981aae53
Instruction Fuzzy Hash: DB4111716042029FDF21CF24D844BABBBE4EF80318F04467FF88582260E739D85ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 004F636F Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004F67B4,00000000,00000000,00000000), ref: 004F6673

Strings

W. Europe Standard Time, xrefs: 004F670C
W. Europe Summer Time, xrefs: 004F6720

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 565725191-690618308
Opcode ID: 37dc3693d64b196c5e882212cddad6af1e0f65f0a5ddd334e881fb4f22ef6d2f
Instruction ID: 9cad27d5f2b54b569fbe64af901152f9cd98cd860f96ba3425b9b03ecf62c301
Opcode Fuzzy Hash: 37dc3693d64b196c5e882212cddad6af1e0f65f0a5ddd334e881fb4f22ef6d2f
Instruction Fuzzy Hash: 91C12672D00119ABDB14BB65DC02ABF7BB9EF04758F11406BFA01EB295E7389E01D798

Uniqueness

Uniqueness Score: -1.00%

Function 00431430 Relevance: 5.5, Strings: 4, Instructions: 493COMMON

Download Yara Rule

Strings

-, xrefs: 0043187D
n: , xrefs: 00430FE9
-, xrefs: 00431853
(, xrefs: 0043199C

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: ($-$-$n:
API String ID: 2638373210-3670314114
Opcode ID: a881d8337272d300521ef66c90245c2cdd44f7d6a9f480f86602a872ce190f3b
Instruction ID: ced5246b7ec2e2c7fa38917ff900392c96e66467ce63cf60e7d8a94b01cea5ec
Opcode Fuzzy Hash: a881d8337272d300521ef66c90245c2cdd44f7d6a9f480f86602a872ce190f3b
Instruction Fuzzy Hash: 9622E170D00288DFCF14DFA8C9597EDBBB0AF15308F14819ED445AB382EBB85A48DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000000,000000FF), ref: 0041F3E5
LocalFree.KERNEL32(?), ref: 0041F414

Strings

jjjj, xrefs: 0041F3D9

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID: jjjj
API String ID: 1561624719-48926182
Opcode ID: aa4404672b2df8b18a26a615dff9fcff1f65acf6459e9ad9dae77a66ff4ba265
Instruction ID: 409469ce869bb278a755ece448acb5b2db033f64c44fe4e4698fcece5c69adc3
Opcode Fuzzy Hash: aa4404672b2df8b18a26a615dff9fcff1f65acf6459e9ad9dae77a66ff4ba265
Instruction Fuzzy Hash: DDF0A7B2C4011896DF109BA49C01BEFB765FB54721F004037DC59A3340EB3948898ADA

Uniqueness

Uniqueness Score: -1.00%

Function 004DB1CB Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,0046BEC7,?,00000000,?,00473681,?,00000000), ref: 004DB1D7
FindFirstFileExW.KERNELBASE(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,0046BEC7,?,00000000,?,00473681,?,00000000), ref: 004DB206
GetLastError.KERNEL32(?,0046BEC7,?,00000000,?,00473681,?,00000000), ref: 004DB218

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: f1d414bdb1a830b9c19e1c1a91ab6db378ddacdc0024ae8e2650c4f043538abd
Instruction ID: 8aa795b071709f9ad919938827d4aff15d16b66e82d9f8c16838a8eaa28f277c
Opcode Fuzzy Hash: f1d414bdb1a830b9c19e1c1a91ab6db378ddacdc0024ae8e2650c4f043538abd
Instruction Fuzzy Hash: D9F05431000508FFDB111FA5DC189AF7B9CEF143B0B108627BD68C56A0D73199A296E4

Uniqueness

Uniqueness Score: -1.00%

Function 00496450 Relevance: 2.0, APIs: 1, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47df8a979cf4f857dc537b9ef44913b95696ce48800f52ac5a31c4eb421a18d
Instruction ID: e16f3952025df4b57fbfa53020dcabc30b9a59b88706b4710c7fb5b6fa6fa324
Opcode Fuzzy Hash: f47df8a979cf4f857dc537b9ef44913b95696ce48800f52ac5a31c4eb421a18d
Instruction Fuzzy Hash: D4028EB06047019FDB64CF29C840B27BBE0AF89314F15493EE48AC7751DB78E949CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00491C30 Relevance: 1.6, APIs: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000003,00000000,7FFFFFFD,?,00000000), ref: 00491D26

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d5e735c4d325f6863c4bbb0d8d2f27c6b16101442465d86a64dd5004bcde936b
Instruction ID: ea3f12589498c6031ede0a0e63da1aa6e190ef39183c8d3f3956d1ebbf566a56
Opcode Fuzzy Hash: d5e735c4d325f6863c4bbb0d8d2f27c6b16101442465d86a64dd5004bcde936b
Instruction Fuzzy Hash: D531BF716043069BDB10CF29D845B9BBBE5EBC4364F144A3EF858833A0E339D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004E925D Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 004E93E1

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 79f90e00dc77957be7610ff531ea09f8d3cb8def4dcd7f8d4dea2ba9a82dffaa
Instruction ID: b0f2f4a4c71a32763588803a0d4209da0bfab023c608772363e77a77a94ad2d5
Opcode Fuzzy Hash: 79f90e00dc77957be7610ff531ea09f8d3cb8def4dcd7f8d4dea2ba9a82dffaa
Instruction Fuzzy Hash: 30B1E17190468A9BCB35CF6BC4956BFB7A1AF08306F140A1FD992973C1C739AD02CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0048C560 Relevance: .7, Instructions: 663COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aead1b18fa6655e2046488e2d56f3586447149cbf6bdb60b8fae25e10e23de9f
Instruction ID: d460b15ecaef89ee619ee12d19a6560aac0686608ff237d971a34b1c2572f41b
Opcode Fuzzy Hash: aead1b18fa6655e2046488e2d56f3586447149cbf6bdb60b8fae25e10e23de9f
Instruction Fuzzy Hash: 4342B070A006458FDB14EE78C8807AEFBA1FF45310F148A6ED4A5E7781D738E54ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0048D250 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0702e79ebe35d7f2eab4924e86644c543a8bfec9af84c7524f60a6a2cffea22b
Instruction ID: 0f76039a442bb9952bef901009f789ffb67366a02fe10e258d8ab1312df69022
Opcode Fuzzy Hash: 0702e79ebe35d7f2eab4924e86644c543a8bfec9af84c7524f60a6a2cffea22b
Instruction Fuzzy Hash: C2B19F71A057019FC720EE69C840A5BB7E1EF88324F144F2EF8AAD3790D778E9458B56

Uniqueness

Uniqueness Score: -1.00%

Function 00442BC0 Relevance: 86.9, APIs: 40, Strings: 8, Instructions: 2868fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 00442C53
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442CAF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004434EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00443639
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0044337F

Part of subcall function 0040E7B0: FindFirstFileA.KERNEL32(00000000,AA515422,?,AA515421,00445E27,00000000,AA515421,AA515422,74DF3100,?), ref: 0040E929

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442CE0

Part of subcall function 0040B1A0: GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
Part of subcall function 0040B1A0: GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00442E08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00442E37
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00442F2F
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443029
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00443087
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004431B8
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0044324A

Strings

!, xrefs: 0044422A
!*3, xrefs: 004436A5
!9, xrefs: 0044303D
!, xrefs: 00443E70
_, xrefs: 00444676
!2, xrefs: 00443A51
!, xrefs: 0044566E
+, xrefs: 00445E83

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: File$CreateDirectory$Copy$FolderPath$AttributesErrorFindFirstLast
String ID: !$!$!$!*3$!2$!9$+$_
API String ID: 3765264142-3231385310
Opcode ID: c97c785990be2afd87e065f286dab4b84683a59cb7c9f88ae3acebcfe4532174
Instruction ID: 1ea3575fd4b082580b03a57aa614fe65a7d59f87011cefd104f53cc2a58c0b7a
Opcode Fuzzy Hash: c97c785990be2afd87e065f286dab4b84683a59cb7c9f88ae3acebcfe4532174
Instruction Fuzzy Hash: A0538D70C04298DADB21EB65CD557DEBB74AF21308F4441EAD449772C2EBB81B88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00474AC0 Relevance: 37.6, APIs: 16, Strings: 5, Instructions: 890
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00474FE3
___std_exception_destroy.LIBVCRUNTIME ref: 00474FF7
___std_exception_destroy.LIBVCRUNTIME ref: 0047510F
___std_exception_destroy.LIBVCRUNTIME ref: 00475123
___std_exception_destroy.LIBVCRUNTIME ref: 004751E0
___std_exception_destroy.LIBVCRUNTIME ref: 004751FA
___std_exception_destroy.LIBVCRUNTIME ref: 00475369
___std_exception_destroy.LIBVCRUNTIME ref: 0047537D
___std_exception_destroy.LIBVCRUNTIME ref: 00475452
___std_exception_destroy.LIBVCRUNTIME ref: 00475466
___std_exception_destroy.LIBVCRUNTIME ref: 0047554C
___std_exception_destroy.LIBVCRUNTIME ref: 00475560
___std_exception_destroy.LIBVCRUNTIME ref: 00475811
___std_exception_destroy.LIBVCRUNTIME ref: 00475825

Strings

object, xrefs: 00475391
number overflow parsing ', xrefs: 0047514A
O, xrefs: 0047582D
value, xrefs: 00475752
array, xrefs: 004752AA

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: O$array$number overflow parsing '$object$value
API String ID: 4194217158-306733086
Opcode ID: 8699a4883028f2283cf753ee7145cf49f00b0654cf6daf8d0f6dfe83358f178b
Instruction ID: 2b8bbb5fb6bef53096142a6844d47d0bb0a5a7ac0895a6da9de1fd59fd81eee6
Opcode Fuzzy Hash: 8699a4883028f2283cf753ee7145cf49f00b0654cf6daf8d0f6dfe83358f178b
Instruction Fuzzy Hash: 4192A170C00248DEDB10DFA4C944BEEBFB5BF55304F14859ED459BB282E7786A48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040CAC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNELBASE(80000002,?,E1121139,0001FFFF,00000001,?,00000104), ref: 0040CBD2
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 0040CC3C
LsaOpenPolicy.ADVAPI32(00000000,0054267C,00000001,00000000), ref: 0040CC95
LsaQueryInformationPolicy.ADVAPI32(00000000,0000000C,?), ref: 0040CCA8
LsaFreeMemory.ADVAPI32(?), ref: 0040CCD6
LsaClose.ADVAPI32(00000000), ref: 0040CCDF

Strings

%wZ, xrefs: 0040CCC5

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ
API String ID: 762890658-705104578
Opcode ID: 166a9ff142172029c0040eea49c4842755af3bf5647daa4c554d03e8e1780dd8
Instruction ID: ed953d859019ede538f053c97b4c3f4d0f04af77b925e9ea28d8cfb3e11cd022
Opcode Fuzzy Hash: 166a9ff142172029c0040eea49c4842755af3bf5647daa4c554d03e8e1780dd8
Instruction Fuzzy Hash: A4615871800308DBEB11CFA4DC49BEEBBB8FF09708F0042AEE545B6181E7B55689CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B1FC
GetLastError.KERNEL32(?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B207
std::_Throw_Cpp_error.LIBCPMT ref: 0040B24F
std::_Throw_Cpp_error.LIBCPMT ref: 0040B260

Strings

\*.*, xrefs: 0040B3B0
DT, xrefs: 0040B3B8
DT, xrefs: 0040B238

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID: \*.*$DT$DT
API String ID: 995686243-3062393244
Opcode ID: 7c93be0e39bac07192ae234e4444476cb8469c1607e3cac452f8ce700f80683a
Instruction ID: 98fd9ba19aa43d818a037ed0b56ad2d2959cead2aa0cd36f25e414e829a489f2
Opcode Fuzzy Hash: 7c93be0e39bac07192ae234e4444476cb8469c1607e3cac452f8ce700f80683a
Instruction Fuzzy Hash: 65110371940600E7CB205BA8A809BBE3654E713728F2087BFD425B77D0D73989048ADE

Uniqueness

Uniqueness Score: -1.00%

Function 0041D430 Relevance: 12.1, APIs: 8, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0041D45A
getaddrinfo.WS2_32(?,?,?,00544318), ref: 0041D4DC
socket.WS2_32(?,?,?), ref: 0041D4FD
connect.WS2_32(00000000,?,?), ref: 0041D511
closesocket.WS2_32(00000000), ref: 0041D51D
freeaddrinfo.WS2_32(?,?,?,?,00544318,?,?), ref: 0041D52A
WSACleanup.WS2_32 ref: 0041D530
freeaddrinfo.WS2_32(?,?,?,?,00544318,?,?), ref: 0041D545

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: 9e175c3fb731f2d83ed7f833e896eca511ac56fc806b49c65e091bf6ddb77191
Instruction ID: 10aaa8cdc1ea530b3675de8615b35e11d712a8cdb30829ada3d8eaee2944026b
Opcode Fuzzy Hash: 9e175c3fb731f2d83ed7f833e896eca511ac56fc806b49c65e091bf6ddb77191
Instruction Fuzzy Hash: 4B31C572904710AFC7209F25DC446ABB7E5BFD4768F144B1EF874972E0E374A8488A96

Uniqueness

Uniqueness Score: -1.00%

Function 004103C0 Relevance: 11.2, APIs: 2, Strings: 4, Instructions: 746COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,0000005C), ref: 00410419
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00410440

Strings

!9, xrefs: 00412117
\, xrefs: 0040F8DF
!?, xrefs: 00411640
z, xrefs: 00411A43

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: !9$!?$\$z
API String ID: 1514166925-421792958
Opcode ID: 4d2ebbe7fbb90f0baa02c41ac1f397a3c42292e9a9788ddd62f773cd65c9a97e
Instruction ID: 33bcead3f6425d6fe5e8ee5dd770ddedfc453baf21d0c58b111339a848723dbc
Opcode Fuzzy Hash: 4d2ebbe7fbb90f0baa02c41ac1f397a3c42292e9a9788ddd62f773cd65c9a97e
Instruction Fuzzy Hash: CF72DE70C0029D9ACF25DB64CD557EDBB74AF11308F0442EAD04977292EBB82B89CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0041D840 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 713libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,00000000,00000000,00000000), ref: 0041DBB6
GetProcAddress.KERNEL32(00000000,D33E2D2A), ref: 0041DBC1
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0041DBD6
GetCurrentProcess.KERNEL32(00000000,?,?,?,00000000,00000000,00000000), ref: 0041DEDC

Strings

!, xrefs: 0041DE0F
Ws2_32.dll, xrefs: 0041DBAD

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcessSend
String ID: !$Ws2_32.dll
API String ID: 3060695839-2514955806
Opcode ID: 654a071ebcfca27028d8c8b3186257bf75a61a552ec29776b5d4993f54e7b2ee
Instruction ID: 01333148d2ba12cff5aab798363fe08ebaf14db0bfb04055ccee031f61c34342
Opcode Fuzzy Hash: 654a071ebcfca27028d8c8b3186257bf75a61a552ec29776b5d4993f54e7b2ee
Instruction Fuzzy Hash: D96224B0D04288DEDF10DFA8C9557EEBFB0AF15308F24415EE4456B282E7B85A84DBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00407490 Relevance: 11.1, APIs: 1, Strings: 5, Instructions: 571COMMON

Download Yara Rule

APIs

Part of subcall function 004778C0: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00477949
Part of subcall function 004778C0: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00477991

GetFileAttributesA.KERNELBASE(?), ref: 004077C1

Strings

, xrefs: 00407B96
/, xrefs: 00407914
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00407CE3
.zip, xrefs: 004075A1
\, xrefs: 004078DB

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ___std_fs_convert_narrow_to_wide@20$AttributesFile
String ID: $.zip$/$\$recursive_directory_iterator::recursive_directory_iterator
API String ID: 2896367778-1520678085
Opcode ID: 2fad60e87e1e802c277f3282e679dfa3b8b58277df00ea7f9a444588ff8a1a58
Instruction ID: 83cbc35ccc226e9dfc96b22cc8f0aa30fdcd4d5be8d4862c17add94487e3c136
Opcode Fuzzy Hash: 2fad60e87e1e802c277f3282e679dfa3b8b58277df00ea7f9a444588ff8a1a58
Instruction Fuzzy Hash: 55429D70D05258DFDB10DFA8C9587DEBBB0BF15308F14819DE4097B282DB785A88CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0046CA20 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 523COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0046CCC0
___std_exception_destroy.LIBVCRUNTIME ref: 0046CCDA
___std_exception_destroy.LIBVCRUNTIME ref: 0046D09A
___std_exception_destroy.LIBVCRUNTIME ref: 0046D0B4

Strings

., xrefs: 0046D156
value, xrefs: 0046CBF7, 0046CFCE

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: .$value
API String ID: 4194217158-1166439862
Opcode ID: e496a2b897f4cc47c3c349c9a923896fd0130218f411de5472431c421e3b0241
Instruction ID: 6bb52dc470a67732b65bfa6fba687dde157c2efc00668daf5dfdc611f465addf
Opcode Fuzzy Hash: e496a2b897f4cc47c3c349c9a923896fd0130218f411de5472431c421e3b0241
Instruction Fuzzy Hash: 09328D70D01288DEDB14CFA9C9547EEBBB1AF15304F24819EE458AB382E7785B48DF52

Uniqueness

Uniqueness Score: -1.00%

Function 004F1AC4 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712faec5eeebce6baaee8b13617faba26b3b358921950160ad50f9a09d9e58b7
Instruction ID: e1f0bbcd43b77d7626f4e77856158d48870e96d21c9a9c54683f95f8a13591de
Opcode Fuzzy Hash: 712faec5eeebce6baaee8b13617faba26b3b358921950160ad50f9a09d9e58b7
Instruction Fuzzy Hash: D5B15974E0424CEFDB11DF99D880BBE7BB1AF56304F14415AE6049B3A2C778AD42CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004EAC03 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 004EAD8B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EADA7
__allrem.LIBCMT ref: 004EADBE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EADDC
__allrem.LIBCMT ref: 004EADF3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EAE11

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 71c8420f77c3c6b4205cd649fa68cc37f68444db08f8c9dfdfe450398f673b61
Instruction ID: 1b3fea5176a95fd5fcec1025af7aaf911d8005413d807e00b03de1864a21ce91
Opcode Fuzzy Hash: 71c8420f77c3c6b4205cd649fa68cc37f68444db08f8c9dfdfe450398f673b61
Instruction Fuzzy Hash: E9811672A00B469BD7209B2FCC41B6B73E9AF40366F24462FF511C6381E778ED10879A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D560 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 244libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041D79A
GetProcAddress.KERNEL32(00000000,D33E2D2A), ref: 0041D7A5
WSASend.WS2_32(0000000F,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041D7BA

Strings

Ws2_32.dll, xrefs: 0041D791

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 9517ec4b1f576d9da9d222c3615f595219f8e349a9d98ca48cb852c8f1395d60
Instruction ID: c78504d2326526b64a61b18178364e1bfccedb5a55b1f6e357964f3563c7d9a6
Opcode Fuzzy Hash: 9517ec4b1f576d9da9d222c3615f595219f8e349a9d98ca48cb852c8f1395d60
Instruction Fuzzy Hash: 4BA177B0E00614DFCB24DF58C8447AEBBF0AF09714F18855EE86AAB381D738AD41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00414233 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 192fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 00414337
std::_Throw_Cpp_error.LIBCPMT ref: 00414482
std::_Throw_Cpp_error.LIBCPMT ref: 00414493

Strings

\, xrefs: 00414253

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$CopyFile
String ID: \
API String ID: 4177132511-2967466578
Opcode ID: f114192478a6e6d6ce68caa2ad7414d5d318043e3c530a0362308b7ada6f61e4
Instruction ID: ec448d641316e2a3872437f4d92d0186c9a642a8506e38dff8007fdda78d9240
Opcode Fuzzy Hash: f114192478a6e6d6ce68caa2ad7414d5d318043e3c530a0362308b7ada6f61e4
Instruction Fuzzy Hash: 8681FC70D00288DFDF04DBE4D945BEDBBB4EF15308F20429EE41067292EBB81A48DB96

Uniqueness

Uniqueness Score: -1.00%

Function 004F4C09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(dN,?,004E64E1,?,?,?,00000000), ref: 004F4C11
GetLastError.KERNEL32(?,004E64E1,?,?,?,00000000), ref: 004F4C1B
__dosmaperr.LIBCMT ref: 004F4C22

Strings

dN, xrefs: 004F4C0E

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: dN
API String ID: 1545401867-1959024296
Opcode ID: 5dc75ce04c15e295acdd42d31dd70232daf278466f7767e5e62d7905f0952de2
Instruction ID: 75627c7e57507863508bb374b15be04f9f819f00b988c6ee8400558b9e74fa4a
Opcode Fuzzy Hash: 5dc75ce04c15e295acdd42d31dd70232daf278466f7767e5e62d7905f0952de2
Instruction Fuzzy Hash: A3D02232000508FB8B002BF2BC0C8573B1CDFD03393100A23F42CC05A0EE35C891A250

Uniqueness

Uniqueness Score: -1.00%

Function 00491300 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 0049131F
GetLastError.KERNEL32 ref: 0049132A
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00491352
GetLastError.KERNEL32 ref: 0049135C

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ErrorFileLast$PointerRead
String ID:
API String ID: 2170121939-0
Opcode ID: fc66bafa82d2f8404cdf7c252faac411a51537015cb655470ecd5fc5aba69e13
Instruction ID: 0b9ab4fa7100161e3312e7656db52f40096a583a722d5ee13f2c0e10fa81db1a
Opcode Fuzzy Hash: fc66bafa82d2f8404cdf7c252faac411a51537015cb655470ecd5fc5aba69e13
Instruction Fuzzy Hash: EA114632600509EBDB108FA9EC05BDABBA8EF55371F008267FD1CC6660E775D9609BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0041EBA0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 267fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AC70: __fread_nolock.LIBCMT ref: 0040AD44

DeleteFileA.KERNELBASE(?), ref: 0041EC07

Strings

3, xrefs: 0041EE37
LLO, xrefs: 0041ED91, 0041EDB1, 0041EDB4, 0041EDB5

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: DeleteFile__fread_nolock
String ID: 3$LLO
API String ID: 3901365830-3436979598
Opcode ID: 28c52cacd2c957560e9c7c0415dc4790710b94966933ca8888bcb898eb906615
Instruction ID: 9c1f0ea9d723b0c493cc9026af37a2a9db30951a99a2893970e01de627fa0d85
Opcode Fuzzy Hash: 28c52cacd2c957560e9c7c0415dc4790710b94966933ca8888bcb898eb906615
Instruction Fuzzy Hash: 46B1CE74E00249DFCB00DF65C804BEEBBB1AF45308F24819AE501AB382D779AE85DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 004F293D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004F2053: GetConsoleOutputCP.KERNEL32(0FD0FE90,00000000,00000000,?), ref: 004F20B6

WriteFile.KERNELBASE(?,00000000,004E6777,?,00000000,00000000,00000000,?,00000000,?,00000000,wgN,00000000,00000000,?,?), ref: 004F2AC2
GetLastError.KERNEL32(?,004E6777,00000000,?,00000000,?,00000000,00000000), ref: 004F2ACC

Strings

wgN, xrefs: 004F293F

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: wgN
API String ID: 2915228174-354891312
Opcode ID: c4e0fab56aaa5aa668606d57f16693d2fff82ef8988b3cb834d35c0f5d62a876
Instruction ID: 58ddb85c8bea4c2b3dbe3e5c994e5fd3db19d053895fb78a9c91e10694f9601d
Opcode Fuzzy Hash: c4e0fab56aaa5aa668606d57f16693d2fff82ef8988b3cb834d35c0f5d62a876
Instruction Fuzzy Hash: BB61A271D0011EAFDF11CFA8CA84EFEBBB9AF19304F14014AEA00A7255D3B9D906CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00439A80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00439BA8
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00439C52

Strings

TbE, xrefs: 00439BAE

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderNamesPathPrivateProfileSection
String ID: TbE
API String ID: 2478605195-3720847194
Opcode ID: e00a99a1756a195747ebc2d94fcb2e2f225bbe9d1b9e17b232250beeccc99cec
Instruction ID: 439a41f54deddd431a1aaf7f453ea8ea4134e207f860afbb2d985c5b74ba0d84
Opcode Fuzzy Hash: e00a99a1756a195747ebc2d94fcb2e2f225bbe9d1b9e17b232250beeccc99cec
Instruction Fuzzy Hash: 55519D74905398DEDB10CBA4CD45BCDBBB8AF15304F1080D9E549AB282D7B86B88CF56

Uniqueness

Uniqueness Score: -1.00%

Function 004060E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 004DE42B: RaiseException.KERNEL32(E06D7363,00000001,00000003,0045DCD0,0045DCD0,?,?,004DAF37,0045DCD0,0053D744,00000000,0045DCD0,00000000,00000001), ref: 004DE48B

___std_fs_directory_iterator_open@12.LIBCPMT ref: 004061E8
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406202

Strings

absolute, xrefs: 00406116

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID: absolute
API String ID: 1297148070-2799662678
Opcode ID: 83d60d2f71de9d8f69fa5d81af5cafba3f0471d6c422f5ef9654ebbd380b6de7
Instruction ID: df52e70302dbc25e70dbc729ec55d43ed626788b5323ae355475d9aa96fec0df
Opcode Fuzzy Hash: 83d60d2f71de9d8f69fa5d81af5cafba3f0471d6c422f5ef9654ebbd380b6de7
Instruction Fuzzy Hash: 9831D071900618ABCB20EF55C945AAFBBB8FF44764F00066AE815773C1DB38AA04CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B270 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00000005,?,?,0045E8D7,00000000,00000000,?,00000000), ref: 0040B2B5

Part of subcall function 004DBDDA: ReleaseSRWLockExclusive.KERNEL32(?,DT,0040B6FD,005444E8,?,?,\*.*,00000004), ref: 004DBDEE

std::_Throw_Cpp_error.LIBCPMT ref: 0040B2E4
std::_Throw_Cpp_error.LIBCPMT ref: 0040B2F5

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 4aa31760ff55f9e8091e016fbf5db6d1ac4fd96c015ccc68c759aad941cf529b
Instruction ID: 2083917a30228ff47c2f58c55b42abb2321d0377fce0ac6287103c5d37e315ef
Opcode Fuzzy Hash: 4aa31760ff55f9e8091e016fbf5db6d1ac4fd96c015ccc68c759aad941cf529b
Instruction Fuzzy Hash: E0F086B5980704EBDB209B5A9D06B9A7A98E702B38F11436FF435533D0E7755A00CAEA

Uniqueness

Uniqueness Score: -1.00%

Function 004EC819 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,004EC813,?,004E1C93,?,?,0FD0FE90,004E1C93,?), ref: 004EC82A
TerminateProcess.KERNEL32(00000000,?,004EC813,?,004E1C93,?,?,0FD0FE90,004E1C93,?), ref: 004EC831
ExitProcess.KERNEL32 ref: 004EC843

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 570eabad1b53be2d073ee1c841cabbe5f8cdf0a80e41f99a4d5a77ab8836c315
Instruction ID: 441ef718a996dc58b5bae7a476c47dbc26188b301f5d8cdfa8241a9a43c48a8d
Opcode Fuzzy Hash: 570eabad1b53be2d073ee1c841cabbe5f8cdf0a80e41f99a4d5a77ab8836c315
Instruction Fuzzy Hash: AED05E32000544FBCF013F62DE4D8993F29BFA0347B448025B86549131DB79895AEA84

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040AC3C

Strings

qZC, xrefs: 0040AC50

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID: qZC
API String ID: 2638373210-99843713
Opcode ID: 76bdb592ddef706300133dbfa687927414c06cad877995d3f5d6c6de751250de
Instruction ID: 3efdec9f11fb5ccab0b93a08b8835ae454c2da5b4ba630b013088ba2f123ba09
Opcode Fuzzy Hash: 76bdb592ddef706300133dbfa687927414c06cad877995d3f5d6c6de751250de
Instruction Fuzzy Hash: 8331B2709043459BDB20EF69C905B6FBBF4EF44704F10066EE5416B2C2D7B99A48CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00463650 Relevance: 3.2, APIs: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004637EB
__fread_nolock.LIBCMT ref: 0046380D

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: ec22e4f50313ced31549da422d7a857b29f27fbc93b2f98bdcf651741bea44c0
Instruction ID: 79d947a9d222d8f0fc42436fae4463b375b8f25b2523b1e7cbdb0ad83c72afb4
Opcode Fuzzy Hash: ec22e4f50313ced31549da422d7a857b29f27fbc93b2f98bdcf651741bea44c0
Instruction Fuzzy Hash: FE618A766042459FCB14CF2DD88096AB7E1EF84325F0486AAFC18CB355EB35DD18CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004144E0 Relevance: 3.1, APIs: 2, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00414675
std::_Throw_Cpp_error.LIBCPMT ref: 00414686

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: ac862eee7d6d7ce6c3a12efbee1ba40941964af439277532c0956238cae26ce1
Instruction ID: d0c1233a766ed38641b4c07237d350fd222a008ab52e14fa55b74dcab28789ba
Opcode Fuzzy Hash: ac862eee7d6d7ce6c3a12efbee1ba40941964af439277532c0956238cae26ce1
Instruction Fuzzy Hash: BB411375E00205CBCB24DF6CD8017AEB7B2FB91708F05062EE815A7392DB78A984DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00406150 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 004061E8
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406202

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: 199b10b5cbcfc3bac638bdf402b44041a05770ed40428cdac618f3dde5b17595
Instruction ID: d4caf346f189b166542986bb95bd81797666f76ba9d979eef76578570dd901e2
Opcode Fuzzy Hash: 199b10b5cbcfc3bac638bdf402b44041a05770ed40428cdac618f3dde5b17595
Instruction Fuzzy Hash: 1D31D072A00618ABCB24EF49D851BAEB7B4EF84764F01066FEC1663780DB396D14CAD4

Uniqueness

Uniqueness Score: -1.00%

Function 004F4253 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004FAD87,004E60B3,00000000,004E60B3,?,004FB028,004E60B3,00000007,004E60B3,?,004FB51C,004E60B3,004E60B3), ref: 004F4269
GetLastError.KERNEL32(004E60B3,?,004FAD87,004E60B3,00000000,004E60B3,?,004FB028,004E60B3,00000007,004E60B3,?,004FB51C,004E60B3,004E60B3), ref: 004F4274

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8b73b785357b2346bfa9b41464cc3ad5fe5b38bc98d19c64144e2217278180d9
Instruction ID: ea2134de0cf5f8181c31f49d7920a3ecd8334c799a4adc26afd63096a676bfd3
Opcode Fuzzy Hash: 8b73b785357b2346bfa9b41464cc3ad5fe5b38bc98d19c64144e2217278180d9
Instruction Fuzzy Hash: 62E08632100614A7CB112BA5AC0C7DE3F98AF80395F028476F60C86160EA3898649798

Uniqueness

Uniqueness Score: -1.00%

Function 00462D20 Relevance: 1.8, APIs: 1, Instructions: 261COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00463084

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0040cee60ca297e69843916d9e08cedfca06c9dd066ab9114cb05fc50e05205c
Instruction ID: 59b4687fba2c297bc731340152e5b068dfc9242d9b83cc7db5c654b00a7a6a14
Opcode Fuzzy Hash: 0040cee60ca297e69843916d9e08cedfca06c9dd066ab9114cb05fc50e05205c
Instruction Fuzzy Hash: 66C139B0901249DFDB00CF69C54479DFBF0AF49314F28C1AEE458AB381E37A9A45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00473140 Relevance: 1.7, APIs: 1, Instructions: 162COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004732BF

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 150b7637050e69aef51a16e820c71c3c63b1338bb9b03a6eedc2294d11a0e4c1
Instruction ID: aa5b3fa2fee637667061d727e0b6404d379ff605ea095809ed05f8f8f5eeafac
Opcode Fuzzy Hash: 150b7637050e69aef51a16e820c71c3c63b1338bb9b03a6eedc2294d11a0e4c1
Instruction Fuzzy Hash: 3851A471E001159FCB08DF69C941AEEB7F5AF98300F14816EE809E7396EB38DE058795

Uniqueness

Uniqueness Score: -1.00%

Function 004E2032 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca496ef47f0e7f3bd31ff4d0c6dd67ba7ae3da1b984ba6e74bea7cea9b832298
Instruction ID: a945f24e44b28e743e936d21751d2e95920c4c00ec505ba9b30c130e86fbcea3
Opcode Fuzzy Hash: ca496ef47f0e7f3bd31ff4d0c6dd67ba7ae3da1b984ba6e74bea7cea9b832298
Instruction Fuzzy Hash: 6151F670A00284AFDF14CF5ACD81AAABFB5EF45315F24815AF9085B352C3B5DE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0043E990 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0043E9E1

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 00292a1e1a46c6d08b35fa9810c9ef956cd47fc03e01ceeaba4aa248ee264165
Instruction ID: 36d381137addb5946eb5037d73dfdd92bc489d8c6fa9d9ee1390ad8f6e1c4cd5
Opcode Fuzzy Hash: 00292a1e1a46c6d08b35fa9810c9ef956cd47fc03e01ceeaba4aa248ee264165
Instruction Fuzzy Hash: 0C512970C04298CAEB14DF64C949BEDB770AF16304F1082DDD0992B2D2DBB91A89CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD80 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040AE5B

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: ce8c8d26a6cf1203399e48e3489b41464c0ac9c413dfbd9d240d27beddf010ef
Instruction ID: c702d2e50921a8ae65e55aa74d458528cfbe078649856ca03a733f80a4f7abb2
Opcode Fuzzy Hash: ce8c8d26a6cf1203399e48e3489b41464c0ac9c413dfbd9d240d27beddf010ef
Instruction Fuzzy Hash: 4D31E770900344EBDB10EF6AC945B9F7BA8EF44754F10006EF505AB2C2D7B99A45CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC70 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040AD44

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3b50b9f4432160aaeec5eb5c4487fedfe5dbb325632b8fe68e188bd048fdc69b
Instruction ID: 372facd2f6f90403c542fea89f6ff45e59fd47fada9579d09d9ccc480ef049f9
Opcode Fuzzy Hash: 3b50b9f4432160aaeec5eb5c4487fedfe5dbb325632b8fe68e188bd048fdc69b
Instruction Fuzzy Hash: 2831F470900248EBDB10EF69DD45B9F7BA8EF44748F10046EF405AB2C2D7B98A05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004F4C31 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004F42CD: RtlAllocateHeap.NTDLL(00000000,004F9713,4D88C033,?,004F9713,00000220,?,004F2C8F,4D88C033), ref: 004F42FF

RtlReAllocateHeap.NTDLL(00000000,00000000,?,004EF921,00000000,?,004FA453,00000000,004EF921,00000012,00000001,?,?,004EF71B,00000001,00000012), ref: 004F4C8E

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2e7b996dfa0404416d11db56eea4719c29d833f3cb97030e177712381e300773
Instruction ID: c197068544b6a74edd42beafa1091b609f8eeec5afa400caf0f2e88d1c1e41a9
Opcode Fuzzy Hash: 2e7b996dfa0404416d11db56eea4719c29d833f3cb97030e177712381e300773
Instruction Fuzzy Hash: BBF0FC3610219DA6C7212A23AC04F7F37589FC2775B17512BFB28962A1EF3CC80155AD

Uniqueness

Uniqueness Score: -1.00%

Function 004F42CD Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,004F9713,4D88C033,?,004F9713,00000220,?,004F2C8F,4D88C033), ref: 004F42FF

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2198638593cbac858731316a311480fbe239b50477190752b525c17ad8c2d171
Instruction ID: 89252cde3629954a7dd651662e79814aadfa885b8aeb937b2ffe9774318fd193
Opcode Fuzzy Hash: 2198638593cbac858731316a311480fbe239b50477190752b525c17ad8c2d171
Instruction Fuzzy Hash: 23E0A02530421896D63126AA9C04BBB3A489BC23B8F160167BF0596291DF2CCC0181FE

Uniqueness

Uniqueness Score: -1.00%

Function 004EF889 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004EF890

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 642ab808bc47696ae728f0514146959be3b190675648a466094860987fb1a248
Instruction ID: 6774f2ffb1e86b77a5a3f95ea0b65f3d51a0f57c6d64d54c353970c0c04ae7a7
Opcode Fuzzy Hash: 642ab808bc47696ae728f0514146959be3b190675648a466094860987fb1a248
Instruction Fuzzy Hash: 66E09AB6C0020DAADB00DFD5C452BEFBBFCAB08304F50412BA205E7141EA7857858BE1

Uniqueness

Uniqueness Score: -1.00%

Function 004EBBBC Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000), ref: 004EBBD9

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5bacf90617f034da2893445faaeab56ee3b919b783a427b181f714fcfbce91ee
Instruction ID: 68ba10a0c8402e923ab1748f6cde1fcb114169dd3f62df60daf3c7347e77fc85
Opcode Fuzzy Hash: 5bacf90617f034da2893445faaeab56ee3b919b783a427b181f714fcfbce91ee
Instruction Fuzzy Hash: 68D06C3205010DFBDF028F84DC06EDA3BAAFB88714F018000BA5856120C732E821EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0043CA61 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(6C630000), ref: 0043CA73

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 1b817b431e1bcb8b8660f8d52eba7c158e344ec8198f08c13cc3c16a208e3d83
Instruction ID: c2aff94c4f18faa8c51ba634006d0e3fc72a7f72d38d24f3f513cb8b6753d3b2
Opcode Fuzzy Hash: 1b817b431e1bcb8b8660f8d52eba7c158e344ec8198f08c13cc3c16a208e3d83
Instruction Fuzzy Hash: 9EC0805844C7C19BD70283704C0C3DEFF547B37308F8800879544D5196F27CC018D611

Uniqueness

Uniqueness Score: -1.00%

Function 0043CA60 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(6C630000), ref: 0043CA73

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f8c40282056245796d7f5b5903a6d79a5f33a872c032442f370485422ea39e21
Instruction ID: 6f1538f3c83fda123e057c8c8b71c8c1581e6641b9bb3c2eae2c166c88091a8e
Opcode Fuzzy Hash: f8c40282056245796d7f5b5903a6d79a5f33a872c032442f370485422ea39e21
Instruction Fuzzy Hash: 47C01228184381AAE702D774AC4C39B3AA8732B308F485046A548AA2A0C2388818EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0041E890 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041E907

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4e61a29468601ae107fcbb5908c62a8ddce1d426291d1a0b980b0851b5dfc28d
Instruction ID: 2d83a94df2baf58943d0f3b62cebef5c529e926cc23f22bb3e5c921deb1b50d4
Opcode Fuzzy Hash: 4e61a29468601ae107fcbb5908c62a8ddce1d426291d1a0b980b0851b5dfc28d
Instruction Fuzzy Hash: CC0170B6D40644ABE720AF599C0ABAE7B54E742B28F14024EE5141B3C1D778184497C6

Uniqueness

Uniqueness Score: -1.00%

Function 0041E930 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041E9A7

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c71fed6dc4406716ad3e82436c4be857b3d0207b63c57079c4abe8ad12ac6a00
Instruction ID: c0ebd88b23e82388457c6e033b9a36544d288d880ff3c5bc3782192cdc59a11b
Opcode Fuzzy Hash: c71fed6dc4406716ad3e82436c4be857b3d0207b63c57079c4abe8ad12ac6a00
Instruction Fuzzy Hash: C80170B6E50644ABD720AB598C06BAE7B64E741B28F14024EE5181B3C1D77818448BC5

Uniqueness

Uniqueness Score: -1.00%

Function 0041E9D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041EA47

Memory Dump Source

Source File: 00000000.00000002.2499170949.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_dendy.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 294e3994608df9d2247225b855f5deb84c7bf25973ab743ac96f85c4bcd2010b
Instruction ID: 0d7175a4dc27f87d51934cd4431bd18cdaf37a0565b35fbcc2f8f436f7c141fc
Opcode Fuzzy Hash: 294e3994608df9d2247225b855f5deb84c7bf25973ab743ac96f85c4bcd2010b
Instruction Fuzzy Hash: D5017B75E44784AFD720EB59DC06BAEBBA4EB51B28F04024EF5142B7C1D7B8184487C5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dendy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_24a29007-21d3-42b0-b4aa-a502308dbc55\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_3876214c-d790-41b5-b5e2-d2ed096deda4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_4f7c52ae-a147-40d8-a3f2-8a9bebe00511\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_79bbe31a-7538-472f-bc88-c4ceabe8f0b1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_7beb78b6-6e28-400c-9bec-333e5a1201c0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_fa6f4377-f796-4dc3-b6a9-a4af4a149016\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_fd7510c0-0ba9-4985-bc35-420bde20bbb7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_bf368937aa71444bfe4b5f2ea5f56432083d3_deda682a_99bc5391-f9a6-410f-81b2-90d93152f0db\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_7c2eca60-39e2-4891-80ad-9cb598a01ab4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_93f7b6c4-5ced-48d1-a491-d06e46313ed7\Report.wer

Windows Analysis Report
dendy.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre